"Overdue invoice #6767390" spam has a malicious .arj attachment

This fake invoice email has a malicious attachment:

From:     Mauro Reddin
Date:     15 September 2014 10:32
Subject:     Overdue invoice #6767390

Morning,

I was hoping to hear from you by now. May I have payment on invoice #84819995669 today please, or would you like a further extension?

Best regards,
Mauro Reddin
+07843 329907

The attachment is an archive file invc_2014-09-15_15-07-11_6767390.arj so in order to get infected you would need an application capable of handling ARJ archives. Once unpacked, there is a malicious executable called invc_2014-09-15_15-07-11_88499270.exe which has a VirusTotal detection rate of just 1/55.

The Comodo CAMAS report shows the malware attemping to phone home to golklopro.com/bitrix/modules.php which is multihomed on a number of IPs that look like a botnet to me.

UPDATE:  The ThreatExpert report also shows an attempted phone-home to cosjesgame.su (also on a botnet) plus an attempted download from the following locations:

teles4.com/333.exe
gavilan.cl/333.exe
emstudio.fr/333.exe
calduler.com/333.exe
iamsaved.org/333.exe

This malware looks like Zbot and is poorly detected by VirusTotal. The ThreatTrack report [pdf] shows that the malware attempts to connect to a bunch of domains that do not currently resolved (listed here [pastebin]).

I recommend that you apply the following blocklist:

golklopro.com
cosjesgame.su
teles4.com
gavilan.cl
emstudio.fr
calduler.com
iamsaved.org
71.204.29.102
80.87.146.106
87.244.34.238
94.154.220.16
109.200.151.96
141.101.28.223
176.36.186.138
178.151.131.75
198.200.87.184
213.110.131.122
213.177.115.141
46.46.104.39
62.122.92.41
91.237.109.103
92.112.228.242
94.244.177.42
95.76.204.117
98.14.34.141
109.161.32.192
109.229.198.37
134.249.73.242
134.249.202.165
194.187.111.74
217.12.122.58
217.175.148.201

Added:
For information, the WHOIS details for cosjesgame.su are as follows:
domain:        COSJESGAME.SU
nserver:       ns1.floujorjnska.su.
nserver:       ns2.floujorjnska.su.
nserver:       ns3.floujorjnska.su.
nserver:       ns4.floujorjnska.su.
state:         REGISTERED, DELEGATED
person:        Private Person
e-mail:        agartudd@85mail.com
registrar:     R01-REG-FID
created:       2014.09.10
paid-till:     2015.09.10
free-date:     2015.10.13
source:        TCI

UPDATE 2014-09-16: a second binary is doing the rounds, the detection rate for this at the moment is 27/55. Initial analysis suggests that it calls home to the same domains and IPs as listed above.