I wonder if something like that might be the case - that this malware escaped early or spread much farther and faster than the authors intended. That would explain the sloppy attempt at an analysis countermeasure that made it trivially easy to shut down the whole thing.