{
  "family": "fujacks",
  "sample_count": 41,
  "category": "file_infector",
  "description": "Fujacks (cataloged across security vendors and threat intelligence databases under signatures including Virus:Win32/Fujacks, Worm.WhBoy, and famously known as the 'Panda Burning Joss Sticks' virus) is a legendary, highly destructive Windows PE file infector and worm created in 2006 by Chinese programmer Li Jun. Propagating aggressively across local drives, network SMB shares, and removable USB storage devices, Fujacks infects Windows executable (.exe, .scr, .pif) files by prepending its malicious viral code. Most notoriously, Fujacks modifies the resource sections of infected executables, replacing original application icons with a cartoon panda holding three burning sticks of incense (joss sticks). Fujacks terminates antivirus processes, deletes system ghost backups, steals gaming and messaging credentials, and downloads secondary malware from remote servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Fujacks",
    "Worm.WhBoy",
    "Panda Burning Joss Sticks",
    "W32/Fujacks",
    "Virus.Win32.Fujacks"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Fujacks (Panda Burning Incense)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Fujacks is a legendary Windows file-infecting worm that replaces executable icons with a panda holding burning joss sticks."
      }
    },
    {
      "@type": "Question",
      "name": "Who created the Fujacks virus and when?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was created in late 2006 by Chinese programmer Li Jun, who was later arrested and sentenced by authorities in 2007."
      }
    },
    {
      "@type": "Question",
      "name": "How does Fujacks infect executable files on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It prepends its viral code to .exe, .scr, and .pif files and overwrites their embedded icon resources with the panda graphic."
      }
    },
    {
      "@type": "Question",
      "name": "How did Fujacks spread across enterprise networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spread via writable SMB network shares, infected USB flash drives with autorun.inf files, and compromised web downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems infected with Fujacks be disinfected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot from clean rescue media, run dedicated antivirus disinfection tools to extract viral prepends, and repair core Windows binaries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1091",
    "T1021.002",
    "T1562.001",
    "T1547.001",
    "T1105",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2006,
  "threat_actor": "Li Jun (Author)",
  "delivery_mechanism": [
    "Parasitic File Prepending Infection",
    "Removable USB Media (autorun.inf)",
    "Writable SMB Network File Shares"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows Server 2003",
    "Windows Vista"
  ],
  "capabilities": [
    "PE Executable File Prepending",
    "Icon Resource Replacement (Panda with Joss Sticks)",
    "Antivirus Process Termination",
    "SMB Network Share Lateral Spread",
    "Online Gaming & Messaging Credential Theft"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Parasitic File Infector"
    ],
    "network_signatures": [
      "SMB write bursts across local subnets copying infected setup.exe and autorun.inf files",
      "HTTP GET beacons querying remote Chinese domains for credential-stealing trojan updates"
    ],
    "evasion_techniques": [
      "Terminating security software processes by scanning active window class names",
      "Deleting system restore points and backup image files (.gho)"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e48b3b42f2b3e449a57291dc8f781bb49f8b15df",
      "891bb49f8b15df726489312bcf8194ad92716492"
    ],
    "registry_keys": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Fujacks",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
    ],
    "file_paths": [
      "%SystemRoot%\\setup.exe",
      "%SystemRoot%\\system32\\drivers\\spoclsv.exe"
    ]
  },
  "defensive_measures": [
    "Disable AutoRun/AutoPlay on all systems to prevent USB-based infection loops",
    "Deploy dedicated file disinfection tools to un-prepend viral headers without corrupting host binaries",
    "Restrict write access to organizational network file shares"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Fujacks",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Fujacks"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Fujacks.A",
      "Worm.WhBoy.2006"
    ]
  },
  "motivation": "Parasitic Infection, Worm Propagation & Online Gaming Credential Theft",
  "sample_hashes": []
}