Fujacks

Overview

Virus:Win32/Fujacks is a highly visible, destructive file infector and worm, notorious for replacing the icons of infected legitimate executables (`.exe`) and web files (`.html`) with an image of a panda burning incense, leading to its nickname 'Panda Burning Incense'.

Understanding Fujacks
To the end-user, a Fujacks infection is instantly recognizable and devastating. Their desktop applications suddenly change icons, programs crash, and network performance plummets. For incident responders, Fujacks represents a chaotic, noisy threat. Unlike stealthy modern trojans, Fujacks physically corrupts files (`T1027.001`) and aggressively spreads across the local network, prioritizing rapid destruction and disruption over covert data theft.

Execution and Evasion Strategies
Fujacks is typically introduced via infected removable media, downloaded executables, or weak network shares. Upon execution, it copies itself to the Windows System directory. It establishes persistence via the Registry Run keys. It then systematically scans the hard drive, injecting its malicious code into every `.exe`, `.scr`, `.pif`, and `.com` file it finds. It also appends malicious IFRAME tags to HTML and ASP files, turning the victim's local web projects into drive-by download vectors (`T1189`). Fujacks actively attempts to terminate AV processes (`T1562.001`) and scans the local subnet, attempting to copy itself to any accessible SMB shares (`T1021.002`).

Indicators of Compromise & Impact
The impact is massive file corruption and widespread system failure. The most obvious IoC is the replacement of legitimate application icons with the 'burning panda' image. EDR platforms will flag a single process rapidly modifying hundreds of executable files across the system (`T1485`). Network logs will show aggressive outbound SMB scanning on port 445. The `HOSTS` file is often modified to block access to security vendor websites.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_FUJACKS {
    meta:
        description = "Detects Fujacks (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "fujacks" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Fujacks Activity
id: c67e4affff530f308c951d1d265b79c7
status: experimental
description: Detects generic indicators of the fujacks malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*fujacks*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly sever the infected endpoint from the network to halt the rapid SMB propagation and prevent the corruption of central file shares.
2. Do NOT attempt to simply delete the infected files; because Fujacks infects legitimate system binaries, deleting them will destroy the OS.
3. Deploy specialized antivirus 'disinfection' routines (if available) to strip the appended virus code and restore the original icons.
4. If disinfection fails or is incomplete, a complete bare-metal rebuild of the operating system is strictly required.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not execute any files from a network share while Fujacks is active; you will instantly execute the virus on your local machine.
2. Avoid assuming standard file deletion works; the virus code is physically merged into the legitimate applications.

References & External Analysis

• Search "fujacks" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Cidox
• Trash
• Cybergate
• Optix
• Goldun

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/fujacks.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.