Just after we posted our blog about the Asprox spam campaign yesterday, we noticed a new Asprox template purporting to be an email from Facebook support. This spam campaign claims the user’s Facebook password has been changed or access to their account has been blocked.
As before, the attachment is the Sasfis trojan, the same breed of downloader Trojan we discussed yesterday. This sample however connects to a different domain; pupmypzed.ru.
The spam may use the following Message body, From and Subject lines.
Just this week, there was outrage when many Facebook users, many of whom were female, found their accounts disabled following an automated Facebook system ‘cleanup’ of dubious accounts. Spammers may have taken advantage of this publicity.
MailMarshal customers are protected from this spam campaign with SpamCensor 525.