GCVE-110-OSM-2026-13945

MyUi 1.2.4 presents itself as a WPF UI component library, but its DLL also contains concealed remote-administration functionality: hardware fingerprinting, HTTPS/TCP server communication, hard-coded API credentials, token-authenticated device registration, arbitrary file and log uploads, remote command states such as UpdateApp, UpdateFile, CloseApp, and CrashApp, plus the ability to launch and kill an external watchdog executable. Calling it malicious is well supported by the combined concealment and provenance evidence. None of these capabilities are disclosed in the package description or README; the public repository contains only benign version 1.0.1 UI code; and the package’s claimed source commit does not exist anywhere in that repository’s complete history. The RAT-like code therefore appears only in the distributed binary, hidden behind a benign UI-library identity and false or unverifiable source provenance—a strong supply-chain malware pattern. Application loads Theme_Base.xaml ↓ MyUi.dll initialization ↓ Fingerprint host CPU ID + motherboard/disk serial + MAC + device name ↓ Authenticate to device.xingkongmt.online hard-coded credentials → bearer token ↓ Register device / open HTTPS and TCP control paths ↓ Receive command state UpdateApp | UpdateFile | UploadLog | DeleteLog CloseApp | CrashApp | ShowTipWin ↓ Upload selected files or zipped AppLogs launch/kill TerminalMirroringWatchDog.exe MyUi.dll is the confirmed first-stage payload. It contains the fingerprinting, C2, upload, process-control, and command-dispatch functionality. Check.json appears to hold command/update state, while TerminalMirroringWatchDog.exe is a referenced second component that may supervise, relaunch, or update the application. The update paths may retrieve or execute further payloads, but the exact downloader and second-stage contents remain unresolved because the watchdog, configuration, server responses, and claimed source commit were withheld from both the package and public repository. No registry/service persistence or general remote shell was confirmed. The concealment is multi-layered: malicious functionality is placed inside a UI DLL, activated through an ordinarily benign WPF theme resource, omitted from documentation, absent from the public source, and attributed to a nonexistent repository commit. The public project is version 1.0.1 while the distributed binary is 1.2.4 with added networking and system-management dependencies. That combination strongly supports classifying it as deliberately malicious supply-chain software, not merely an undocumented administrative feature. /opt/osm/killchain was not run because it only supports npm/Python analysis; its kill-chain model nevertheless matches the sequence abov