Sasfis
Aliases: Oficla
- First seen
- 2012-01-01 00:00:00
- Malware type
- downloader
- Family
- Malware family
- Profile updated
- 2026-07-07 14:45:37
Context
Sasfis acts mostly as a downloader that has been observed to download Asprox and FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the same group as SmokeLoader.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Sasfis_Auto (yara-rule)
Reports & references
- virusbulletin.com — Tracking 2012 Sasfis Campaign (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sasfis (report)
- Trend Micro — Sasfis Malware Uses A New Trick (report)
- sophos.com — Detailed Analysis (report)
- Trend Micro — Sasfis Fizzles In The Background (report)
- Broadcom/Symantec — 2010 020210 5440 99 (report)
- Trend Micro — Sasfis (report)
- isc.sans.edu — 8860 (report)