Loading malware…
OneHalf is a DOS-based polymorphic computer virus discovered in 1994 and associated with Slovakia. It is a hybrid boot-and-file infector that compromises the master boot record and infects executable files, including COM, EXE, and SCR formats. The malware is notable for early use of patchy infection techniques, in which viral code is inserted into multiple locations within a host file rather than appended in a conventional manner, complicating detection and analysis.
Its defining payload is progressive disk encryption. On each boot, OneHalf encrypts additional portions of the hard drive using XOR with a randomly generated key while temporarily decrypting accessed data on the fly to reduce user suspicion. It also conceals the original master boot record from software running on the infected system. Once roughly half of the disk has been encrypted, or on certain calendar dates under specific conditions, it displays a characteristic message to the user. Because the malware leaves encrypted data behind, incomplete remediation can render the victim's files inaccessible; safe cleanup requires decrypting the affected disk before removing the virus. Multiple variants of OneHalf have been documented, but they retain broadly similar behavior.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Contrary to the usual method of infecting executables (which is to append virus body to the executable and to change the entry point), it inserts several fragments ("patches") of its code in random places inside the file. These fragments transfer control to each other using various mechanisms. The method of infection makes the detection of the virus difficult by anti-virus programs
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OneHalf is referenced as an older virus that infected MBRs and encrypted disk contents, but did not extort money.
DOS-based polymorphic virus that infects the master boot record and .COM, .SCR, and .EXE files. Its payload progressively encrypts portions of the hard disk while transparently decrypting accessed data to avoid user detection, and it hides the real MBR to hinder detection and removal.
A computer virus referenced for using an infection method similar to Bomber's 'patchy infection' technique.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.