MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the message that your facebook account has been blocked because of spam that was sent from your account. The email indicates that the password of your account has been reset and that you should open the attached document with your new password.

Following subjects are possible – or similar:

Facebook Service. Your password has been changed. ID309
Facebook Service.Your acciunt is blocked. ID799
Facebook Support. Your password has been changed. ID991
Facebook Support. A new password is sent  to you. 920

The email is send from the spoofed address “Facebook office <donotreply.nr.6170@facebook.com>” – note that the from before the @ changes with each email – and has the following body:

This is a post notification!

A spam is sent from your Facebook account.
Your password has been changed for safety.

Information regarding your account and a new password is attached to the letter.
Read this information thoroughly and change the password to complicated one.

Thank you for your attention,
Facebook Service.

The attachedZIP file has the name Facebook_document_Nr59469.zip and contains the folder Facebook_document with inside the 60 kB large file Facebook_document.exe.

The trojan is known as Trojan.Win32.Oficla (Ikarus), W32/Trojan3.CIG (F-Prot), Trojan:Win32/Oficla.AE (Microsoft), Trojan.Sasfis (Symantec).

The following files will be created:

%Temp%.tmp
%System%\ttux.qqo
%Temp%.tmp

Several Windows registry changes will be exectued and the trojan can establish connection with the following IPs on port 80:

85.195.104.161
91.204.48.46

Data can be obtained from following URLs:

* http://pupmypzed.ru/alimp/bb.php?v=200&id=738176302&b=1711_fa&tm=1
* http://pupmypzed.ru/alimp/bb.php?v=200&id=738176302&tid=4&b=1711_fa&r=1&tm=1
* http://91.204.48.46/test/dot.exe

Virus Total permlink and MD5: 16e7189085f1135d0ee38b56928811be.

Source: mxlab – all about anti virus and anti spam

• “Facebook Support. Your password has been changed!” contains trojan
  MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Facebook Support. Your password has been changed! ID09687″. Note that the nu...
• Facebook Password Has Been Changed…NOT!
  We've already seen spam campaign theme that uses one of the famous Social Networking sites, Facebook. Like, Facebook Password Reset Confirmation, New login system, and Facebook updated account agreeme...
• “New Facebook password!” emails contains W32/Oficla.BC trojan
  MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “New Facebook password!” The email is send from the spoofed address “&#...
• New Oficla trojan in emails with subject “Your facebook password has been changed”
  MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Your facebook password has been changed″ The email is send from the spoofed address “You...
• Email with Guys & Dolls ZIP file contains trojan
  MX Lab intercepted some emails with the subject “Ad third try” with attached a ZIP file named Guys & Dolls_displayad.zip. The message comes from a spoofed email address and has the fol...
• Email regarding Western Union transaction contains the Oficla trojan
  MX Lab intercepted a new trojan variant in emails with the subject “The transfer is available to withdrawl. Western Union.” regarding a money transaction. The email is sent from the spoofe...
• Email “Statement of fees 2009/2010″ contains trojan
  MX Lab intercepts a new trojan variant in emails with the subject “Statement of fees 2009/2010″. The trojan is known as Trojan.Sasfis (Symantec), Suspicious:W32/Malware!Gemini (F-Secure) o...
• Email with subject “Outlook Setup Notification” contains trojan
  MX Lab intercepted a few emails with the subject “Outlook Setup Notification”. The message contains instructions to re-configure Microsoft Outlook and to open the attached zip file. The me...
• “Thank you for buying iTunes Gift Certificate!” email contains trojan
  MX Lab started to intercept emails with the subject “Thank you for buying iTunes Gift Certificate!” with the trojan Gen:Variant.Bredo.4 (Bitdefender, F-Secure), Win32/Oficla.GQ (NDO32), Tr...
• Malware spreading via ‘Facebook Password Reset Confirmation’ email
  Facebook users are once again under attack. A new variant of Bredolab Trojan is spreading through spam email messages appearing to come from Facebook. The messages pretend to come from the &ld...