MALWARE FAMILY

Sasfis

Internal ID: win.sasfis

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Sasfis acts mostly as a downloader that has been observed to download Asprox and FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the same group as SmokeLoader.

Threat Analysis

Sasfis is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-malware-uses-a-new-trick/

→https://www.symantec.com/security-center/writeup/2010-020210-5440-99

→https://isc.sans.edu/forums/diary/Sasfis+Propagation/8860/

→https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-fizzles-in-the-background/

→https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/sasfis

→https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Sasfis-O/detailed-analysis.aspx

→https://www.virusbulletin.com/virusbulletin/2012/11/tracking-2012-sasfis-campaign

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.sasfis

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Sasfis