>I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the

>I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. On the face of it, that sounds like amateur hour. At the end of the day virtual environments can be configured to fool the malware in whatever fashion is required. However, I can see that method buying small amounts of time for the worm to continue infecting targets, which I suppose has utility.