New spam with Sasfis attached

There is a new set of spam emails going around that looks like this:

We recorded a payment request from [company name] to
enable the charge of [amount] on your account.

The payment is pending for the moment.

If you made this transaction or if you just authorize this
payment, please ignore or remove this email message. The
transaction will be shown on your monthly statement as [comapny name].

If you didn't make this payment and would like to decline it, please
download and install the transaction inspector module (attached to this letter).

The attachment is the Sasfis dropper in a zip file.  Once installed this will download a copy of the Zbot trojan to your computer.  If you see an email like this you should delete it immediately.

Tagged with: ,
Posted in malware, spam