4

According to this Wikipedia article about the Sobig Worm, the worm

deactivated itself on September 10, 2003

Why would a worm (or any malware for that matter) deactivate itself? Why not stay on a host computer to try to continue to do more damage?

4
  • why make it in the first place?
    – dandavis
    Aug 24, 2016 at 21:21
  • If you read the forensic report linked on that wiki page, it explains why this particular worm self-destructed
    – schroeder
    Aug 24, 2016 at 21:24
  • @dandavis I offer you the same response as above ...
    – schroeder
    Aug 24, 2016 at 21:25
  • 1
    I think the question is meant to be more general. Lots of malware deactivates itself and sometimes even keys needed to decrypt files are released without apparent reason.
    – Thomas
    Aug 28, 2016 at 7:52

1 Answer 1

6

We are developing customized malware for our customers to simulate APT (advanced persistent threats) within professional penetration tests. Disabling malware in our case has an important purpose: To prevent activities (e.g. infections) after the end of a project.

In case of malware in-the-wild the goal might be to prevent further access to other resources like web server. For example if the developer knows that the C&C servers won't be around at that future time anyway.

Highly professional malware with stealth capabilities might deactivate itself to prevent detection or to make a reverse engineering much harder. The attackers might want to get access and then steal a specific set of data or switch to another communication capability. The malware for the initial break-in shall stay unknown because the technique might be very valuable or the approach might reveal something about the source or targets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .