C++ standard library use in malware

Question

I was recently analyzing the sources of ZeuS, ZeroAccess, Carberp and other professional malware and there was one thing which I found weird:

The authors did not use the standard library std::-functions very frequently when they could have. I mean stuff like std::fstream / std::string / std::cout (for debugging).

My question is why? A lot of tasks could be accomplished easier if they would use these functions. I don't think efficiency was their concern since the speed boost wouldn't be worth the time spend.

Source example here

Answer 1

When writing a malware, you should make as few assumptions as possible on the libraries existing on the target (victim) machine. As the sources you show in comment are for Windows, all you can safely assume is that the functions for WINAPI calls will be available, because any additional dependency on redistributable bits for any C or C++ system may be present or not: many Window machines have no installed development tools, and they only have the libraries (DLL) that were required by other software.

That means that to be able to use functions from the C++ (or even C) library, the developper should statically link the used standard library resulting in a heavy application, when a malware should be tiny in order not to sched light on it because of its size.

That's a possible reason why the developpers of Zeus make an intensive usage of WINAPI calls and avoid calls to the C standard library, not speaking of the C++ one which would add a new layer and some overhead in size.

Answer 2

Also I might think of it being a way to obfuscate code in order to by pass detection.

If an antivirus has the use of standard libraries used in such a way as a trigger for malicious code then they may just not use those libraries and go about a different weird way of doing things on purpose.

Answer 3

It is due to the needs to run the process silently. What happen when you try to run an executable with missing dll ? an error messages or an install shield will be trigger. The coder do not want this because the main objective is to run on more machines as possible. By using "std" library the coder avoid some dependencies issues and he will be sure that the software will run on every machine.