I reversed it and found a new kill-switch
WannaCry — New Variants Detected!
Matt Suiche

Sorry if this question had been asked previously, but can it be not so much as kill-switch but more a (clumsy) sandbox detector? Seems like some basement monkey coders are using NSA weapon-class exploit just to quickly grab some cash and to close up shop. Does malware even bother to check victims’ payment statuses? I’ll be not at all amazed if it doesn’t.

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.