According to this Wikipedia article about the Sobig Worm, the worm
deactivated itself on September 10, 2003
Why would a worm (or any malware for that matter) deactivate itself? Why not stay on a host computer to try to continue to do more damage?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
We are developing customized malware for our customers to simulate APT (advanced persistent threats) within professional penetration tests. Disabling malware in our case has an important purpose: To prevent activities (e.g. infections) after the end of a project.
In case of malware in-the-wild the goal might be to prevent further access to other resources like web server. For example if the developer knows that the C&C servers won't be around at that future time anyway.
Highly professional malware with stealth capabilities might deactivate itself to prevent detection or to make a reverse engineering much harder. The attackers might want to get access and then steal a specific set of data or switch to another communication capability. The malware for the initial break-in shall stay unknown because the technique might be very valuable or the approach might reveal something about the source or targets.