3 ms·
It's not supposed to be a kill switch. (Even though it works as one.) The domain check is there to detect whether the infection is running in a sandbox environ
by tjohns 9y ago
It's not supposed to be a kill switch. (Even though it works as one.)
The domain check is there to detect whether the infection is running in a sandbox environment. If the domain check succeeds, it assumes it's being analyzed and aborts.
Or at least that's the prevailing theory.
- cmh1729 9y agoIs there some fundamental reasons why the domain check would always succeed in a sandbox? Would this not be simple to workaround by security researchers?