Sasser Worm Technical Intelligence Dossier

Executive Summary & Threat Architecture

Sasser (classified across antivirus vendors as W32.Sasser, Worm.Win32.Sasser, and Win32/Sasser) is one of the most disruptive self-replicating computer worms in the history of the internet, authored by 17-year-old German high school student Sven Jaschan (who also created the Netsky mass-mailing worm) and unleashed on April 30, 2004. Unlike conventional email worms of the era that required users to open an infected attachment, Sasser was completely autonomous: it scanned random IP addresses on TCP port 445 looking for unpatched systems running Microsoft Windows 2000, Windows XP, and Windows Server 2003. When an open system was identified, Sasser exploited a critical stack buffer overflow in the Local Security Authority Subsystem Service (LSASS) via the DsRolerUpgradeDownlevelServer RPC API (CVE-2004-0280 / MS04-011). The exploit triggered arbitrary shellcode execution, opening a remote command shell on TCP port 9996 and downloading the full worm executable ('avserve.exe' or 'avserve2.exe') from the attacking host via an FTP server spawned on TCP port 5554. Sasser caused lsass.exe to terminate with an unhandled exception (status code 0xC0000005), which forced Windows to display a critical system dialog with a 60-second countdown timer before automatically restarting the computer. The worm spread with such exponential ferocity that within 48 hours it infected millions of computers globally, grounding Delta Air Lines flights, closing one-third of post offices in Taiwan, halting satellite communications for French news agency AFP, and paralyzing operations at British investment banks and public hospitals. Jaschan was arrested in May 2004 following a joint investigation by German police and Microsoft.

Observed Threat Aliases: W32.Sasser, Worm.Win32.Sasser, Win32/Sasser.A, Sasser Worm, W32/Sasser.worm

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: netsky

Documented Downstream Variants: sasser_a, sasser_b, sasser_c, sasser_d

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Sasser Worm operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Autonomous network worm propagation exploiting LSASS buffer overflow CVE-2004-0280 over SMB TCP port 445
• Automated FTP payload transfer on TCP port 5554 spawning remote shell on port 9996

Host Persistence & Execution Hooks

• Registry Run key under HKLM\Software\Microsoft\Windows\CurrentVersion\Run pointing to avserve.exe in %WINDIR%
• Automatic spawning of background scanning threads upon user login

Reference File Hashes (SHA-256)

• a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671
• 5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102