Yeah that analysis is... not great. It looks like an instance of 'xred': https://s.tencent.com/research/report/880.html https://s.tencent.com/research/report/8

Yeah that analysis is... not great. It looks like an instance of 'xred': https://s.tencent.com/research/report/880.html https://s.tencent.com/research/report/880.html Which seemingly infects .exes (ie., is not just a worm), so it's totally possible that the OEM here isn't acting maliciously, but they just got infected themselves.