4

According to this Wikipedia article about the Sobig Worm, the worm

deactivated itself on September 10, 2003

Why would a worm (or any malware for that matter) deactivate itself? Why not stay on a host computer to try to continue to do more damage?

  • why make it in the first place? – dandavis Aug 24 '16 at 21:21
  • If you read the forensic report linked on that wiki page, it explains why this particular worm self-destructed – schroeder Aug 24 '16 at 21:24
  • @dandavis I offer you the same response as above ... – schroeder Aug 24 '16 at 21:25
  • 1
    I think the question is meant to be more general. Lots of malware deactivates itself and sometimes even keys needed to decrypt files are released without apparent reason. – Thomas Aug 28 '16 at 7:52
6

We are developing customized malware for our customers to simulate APT (advanced persistent threats) within professional penetration tests. Disabling malware in our case has an important purpose: To prevent activities (e.g. infections) after the end of a project.

In case of malware in-the-wild the goal might be to prevent further access to other resources like web server. For example if the developer knows that the C&C servers won't be around at that future time anyway.

Highly professional malware with stealth capabilities might deactivate itself to prevent detection or to make a reverse engineering much harder. The attackers might want to get access and then steal a specific set of data or switch to another communication capability. The malware for the initial break-in shall stay unknown because the technique might be very valuable or the approach might reveal something about the source or targets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.