This is my curiosity based question, neither I am a virus writer nor trying to learn how to be, I just can't imagine these people destroy dozens of computers for each virus as per my understanding software is software - it needs to be tested.
2In VMs? You may want to check how anti-viruses are tested. "Chapter 20 Clam Anti-Virus: Testing Open Source with Open Tools" in the book "Beautiful Testing: Leading Professionals Reveal How They Improve Software" reveals that.– dzieciouDec 9, 2017 at 8:53
Thanks for your comment @dzieciou but My curiosity is in Virus its self After as a virus its self a software. Right– Nitin RastogiDec 9, 2017 at 9:03
it needs to be tested
Does it? If you release a virus into the wild and it does not infect anyone you could say that is a form of testing in production. Gives enough feedback to see if you are on the right track, not? Testing in production is not always a bad thing, estimate your risks. Can you monitor the behaviour of the application continuously and adapt?
How do computer virus writers test their viruses?
Let imagine you are virus writer for a government agency. How would testing the software be different then any other form of software testing? You have expected behaviour which you need to validate, just like with any other piece of software. Second you would want some form of risk analyses. Chance it can be tracked back to its creator, Chance it would be found fast, Does it pass regular anti-virus protection, etc... leading to test and mitigation actions.
Depending on your target you might need to simulate its environment. I guess you could setup a couple of virtual or physical machines to simulate the network you would like to penetrate. E.g. testing a StuxNet targeting specific components in nuclear-power-plants is different then generating e-mail zombies. Still to test it you would likely need to have a simulation environment. Just like a testing/staging environment, just a little bit more complex in some cases.