According to this Wikipedia article about the Sobig Worm, the worm
deactivated itself on September 10, 2003
Why would a worm (or any malware for that matter) deactivate itself? Why not stay on a host computer to try to continue to do more damage?
-
why make it in the first place?– dandavisAug 24, 2016 at 21:21
-
If you read the forensic report linked on that wiki page, it explains why this particular worm self-destructed– schroeder ♦Aug 24, 2016 at 21:24
-
@dandavis I offer you the same response as above ...– schroeder ♦Aug 24, 2016 at 21:25
-
1I think the question is meant to be more general. Lots of malware deactivates itself and sometimes even keys needed to decrypt files are released without apparent reason.– ThomasAug 28, 2016 at 7:52
Add a comment
|
1 Answer
We are developing customized malware for our customers to simulate APT (advanced persistent threats) within professional penetration tests. Disabling malware in our case has an important purpose: To prevent activities (e.g. infections) after the end of a project.
In case of malware in-the-wild the goal might be to prevent further access to other resources like web server. For example if the developer knows that the C&C servers won't be around at that future time anyway.
Highly professional malware with stealth capabilities might deactivate itself to prevent detection or to make a reverse engineering much harder. The attackers might want to get access and then steal a specific set of data or switch to another communication capability. The malware for the initial break-in shall stay unknown because the technique might be very valuable or the approach might reveal something about the source or targets.
