Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 14:05:59 UTC
 Tool: Sasfis
Names
Sasfis
Oficla
Category Malware
Type Downloader
Description
Sasfis acts mostly as a downloader that has been observed to download Asprox and
FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the
same group as SmokeLoader.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 30 November 2023
Download this tool card in JSON format
All groups using tool Sasfis
Changed Name Country Observed
Other groups
 Smoky Spider [Unknown] 2011-Apr 2019
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5d6311a3-d859-4832-92c4-8bff582b24de
Page 1 of 2

1 group listed (0 APT, 1 other, 0 unknown)
↑
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5d6311a3-d859-4832-92c4-8bff582b24de
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5d6311a3-d859-4832-92c4-8bff582b24de
Page 2 of 2