{
  "family": "sasser",
  "sample_count": 25,
  "category": "worm",
  "description": "Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in the history of the internet, authored by 17-year-old German high school student Sven Jaschan (who also created the Netsky mass-mailing worm) and unleashed on April 30, 2004. Unlike conventional email worms of the era that required users to open an infected attachment, Sasser was completely autonomous: it scanned random IP addresses on TCP port 445 looking for unpatched systems running Microsoft Windows 2000, Windows XP, and Windows Server 2003. When an open system was identified, Sasser exploited a critical stack buffer overflow in the Local Security Authority Subsystem Service (LSASS) via the DsRolerUpgradeDownlevelServer RPC API (CVE-2004-0280 / MS04-011). The exploit triggered arbitrary shellcode execution, opening a remote command shell on TCP port 9996 and downloading the full worm executable ('avserve.exe' or 'avserve2.exe') from the attacking host via an FTP server spawned on TCP port 5554. Sasser caused lsass.exe to terminate with an unhandled exception (status code 0xC0000005), which forced Windows to display a critical system dialog with a 60-second countdown timer before automatically restarting the computer. The worm spread with such exponential ferocity that within 48 hours it infected millions of computers globally, grounding Delta Air Lines flights, closing one-third of post offices in Taiwan, halting satellite communications for French news agency AFP, and paralyzing operations at British investment banks and public hospitals. Jaschan was arrested in May 2004 following a joint investigation by German police and Microsoft.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "W32.Sasser",
    "Worm.Win32.Sasser",
    "Win32/Sasser.A",
    "Sasser Worm",
    "W32/Sasser.worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Sasser worm and how did it infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sasser was an autonomous network worm that spread in April 2004 by scanning random IP addresses and exploiting a buffer overflow in the Windows LSASS service (CVE-2004-0280 / MS04-011) over TCP port 445 without user interaction."
      }
    },
    {
      "@type": "Question",
      "name": "Why did Sasser cause computers to restart with a 60-second timer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The exploit caused lsass.exe to crash. Because LSASS is a critical system service, Windows initiated an emergency system shutdown countdown via shutdown.exe."
      }
    },
    {
      "@type": "Question",
      "name": "Who created Sasser and what happened to the author?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sasser was created by 17-year-old Sven Jaschan in Germany. He was arrested in May 2004 following a $250,000 bounty offered by Microsoft, and received a suspended juvenile sentence."
      }
    },
    {
      "@type": "Question",
      "name": "What major global disruptions did Sasser cause?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sasser grounded Delta Air Lines flights, disrupted satellite communication for news agencies, forced bank branches and post offices to close, and infected hospitals across Europe and Asia."
      }
    },
    {
      "@type": "Question",
      "name": "How was Sasser mitigated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By applying Microsoft Security Bulletin MS04-011, blocking inbound TCP port 445 at perimeter firewalls, and using removal tools to delete avserve.exe."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1210",
    "T1059",
    "T1547.001",
    "T1083",
    "T1498"
  ],
  "cisa_advisory": null,
  "exploited_cves": [
    "CVE-2004-0280"
  ],
  "iocs": {
    "file_hashes": [
      "a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671",
      "5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102"
    ],
    "delivery": [
      "Autonomous network worm propagation exploiting LSASS buffer overflow CVE-2004-0280 over SMB TCP port 445",
      "Automated FTP payload transfer on TCP port 5554 spawning remote shell on port 9996"
    ],
    "persistence": [
      "Registry Run key under HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run pointing to avserve.exe in %WINDIR%",
      "Automatic spawning of background scanning threads upon user login"
    ]
  },
  "lineage": {
    "derived_from": [
      "netsky"
    ],
    "variants": [
      "sasser_a",
      "sasser_b",
      "sasser_c",
      "sasser_d"
    ]
  },
  "ecosystem": [
    "windows",
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "lateral_movement",
    "impact"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "Microsoft Security Bulletin MS04-011: Security Update for Microsoft Windows (835732)",
      "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011"
    },
    {
      "name": "F-Secure Threat Description: Sasser Worm",
      "url": "https://www.f-secure.com/v-descs/sasser.shtml"
    },
    {
      "name": "BBC News: Sasser Worm Disrupts Global Systems",
      "url": "http://news.bbc.co.uk/2/hi/technology/3680267.stm"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}