The malware overwrites master boot record (MBR) as described here: Trojan.Jokra – Symantec* DarkSeoul: SophosLabs identifies malware used in South Korean internet attack. South Korean Banks, Media Companies Targeted by Destructive Malware – McAfee. South Korea Banks and Broadcasting Organizations Suffer Major Damage from Cyber Attack. Email me if you need the password: “openegeo,” or “geogeo”, to use the password.”]
Source: http://contagiodump.blogspot.com/2013/03/darkseoul-jokra-mbr-wiper-samples.html