Kill-Switch Domain Check

What It Does

A malware sample contains a hardcoded domain or URL that it queries at startup (typically via HTTP GET). If the query succeeds — meaning the domain is registered, resolves, and returns any HTTP response — the payload aborts execution. If the query fails (NXDOMAIN, timeout, or HTTP error), the malware proceeds with its malicious behavior.

This is a circuit-breaker mechanism, not traditional anti-VM. Its original purpose is typically operator-controlled deactivation (e.g., the malware author can register the domain to stop an outbreak). In the case of wannacry, the kill-switch domain was discovered and sinkholed by a researcher, accidentally stopping the global May 2017 outbreak.

Detection / Fingerprint

Look for these patterns in static analysis:

1. Plaintext hardcoded URL — often a nonsense or random-looking domain (e.g., iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com)
2. WinInet or WinHTTP calls early in execution:
   • InternetOpenA → InternetOpenUrlA → InternetReadFile
   • Or WinHttpOpen → WinHttpConnect → WinHttpOpenRequest
3. Conditional branch on HTTP success — the malware checks return codes (200, 404, or even non-zero) and exits if satisfied
4. No encoding — many early implementations left the domain in plaintext ASCII; later variants use XOR, Base64, or RC4

Implementation Patterns Observed

WannaCry (2017)

• Domain: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
• API: InternetOpenUrlA ^[raw/analyses/16fdcfbc/report.md]
• Behavior: If HTTP GET returns any data, ExitProcess is called before encryption begins
• Opsec failure: Domain was hardcoded in plaintext, enabling global sinkholing

Reproduce on Your Own VMs

Goal: Build a minimal EXE that demonstrates the kill-switch pattern.

Toolchain: MinGW-w64 or MSVC, Windows target.

Code snippet (C, WinInet):

#include <windows.h>
#include <wininet.h>
#pragma comment(lib, "wininet.lib")

int main() {
    HINTERNET hInternet = InternetOpenA("Mozilla/5.0", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
    if (!hInternet) return 1;

    HINTERNET hUrl = InternetOpenUrlA(hInternet, "http://your-killswitch.test/stop", NULL, 0, 0, 0);
    if (hUrl) {
        // Kill switch active — abort
        InternetCloseHandle(hUrl);
        InternetCloseHandle(hInternet);
        return 0;  // Exits cleanly, no payload
    }

    // Kill switch unreachable — proceed with payload
    MessageBoxA(NULL, "Payload would execute here", "Kill-Switch Demo", MB_OK);
    InternetCloseHandle(hInternet);
    return 0;
}

Compiler flags:

x86_64-w64-mingw32-gcc killswitch.c -o killswitch.exe -lwininet -mwindows

Verification:

1. Run killswitch.exe without the domain resolving → payload message box appears
2. Add your-killswitch.test to hosts pointing to 127.0.0.1, run a local HTTP server on port 80 → payload is suppressed
3. Run capa killswitch.exe — should hit connect to URL, check internet connectivity, or similar

What you'll learn: How trivially easy a kill switch is to implement, and why it is a double-edged sword (operators can stop outbreaks, but analysts can discover and sinkhole the domain).

Defensive Countermeasures

• Sinkhole the domain — register or DNS-sinkhole the hardcoded domain to neutralize the malware
• DNS monitoring — alert on new DNS queries to long, random, or recently-registered domains from endpoints
• Host-based rules — flag processes that make an HTTP request and then immediately terminate without file/network activity

Pages Where Observed

• wannacry — 16fdcfbc DLL variant with plaintext hardcoded kill switch ^[raw/analyses/16fdcfbc/report.md]