{
  "family": "fujacks",
  "sample_count": 41,
  "category": "trojan",
  "description": "Virus:Win32/Fujacks is a highly visible, destructive file infector and worm, notorious for replacing the icons of infected legitimate executables (`.exe`) and web files (`.html`) with an image of a panda burning incense, leading to its nickname 'Panda Burning Incense'.<br><br><b>Understanding Fujacks</b><br>To the end-user, a Fujacks infection is instantly recognizable and devastating. Their desktop applications suddenly change icons, programs crash, and network performance plummets. For incident responders, Fujacks represents a chaotic, noisy threat. Unlike stealthy modern trojans, Fujacks physically corrupts files (`T1027.001`) and aggressively spreads across the local network, prioritizing rapid destruction and disruption over covert data theft.<br><br><b>Execution and Evasion Strategies</b><br>Fujacks is typically introduced via infected removable media, downloaded executables, or weak network shares. Upon execution, it copies itself to the Windows System directory. It establishes persistence via the Registry Run keys. It then systematically scans the hard drive, injecting its malicious code into every `.exe`, `.scr`, `.pif`, and `.com` file it finds. It also appends malicious IFRAME tags to HTML and ASP files, turning the victim's local web projects into drive-by download vectors (`T1189`). Fujacks actively attempts to terminate AV processes (`T1562.001`) and scans the local subnet, attempting to copy itself to any accessible SMB shares (`T1021.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive file corruption and widespread system failure. The most obvious IoC is the replacement of legitimate application icons with the 'burning panda' image. EDR platforms will flag a single process rapidly modifying hundreds of executable files across the system (`T1485`). Network logs will show aggressive outbound SMB scanning on port 445. The `HOSTS` file is often modified to block access to security vendor websites.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1485",
    "T1027.001",
    "T1021.002",
    "T1091"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1027.001",
      "name": "Obfuscated Files or Information: Indicator Removal from Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the rapid SMB propagation and prevent the corruption of central file shares.",
    "Do NOT attempt to simply delete the infected files; because Fujacks infects legitimate system binaries, deleting them will destroy the OS.",
    "Deploy specialized antivirus 'disinfection' routines (if available) to strip the appended virus code and restore the original icons.",
    "If disinfection fails or is incomplete, a complete bare-metal rebuild of the operating system is strictly required."
  ],
  "what_to_avoid": [
    "Do not execute any files from a network share while Fujacks is active; you will instantly execute the virus on your local machine.",
    "Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}