"Kifilwe Shakong" "Copied invoices" spam

Kifilwe Shakong is a real person who works for Cashbuild in South Africa. She is  not the person sending these messages, they are forgeries. Cashbuild's systems have not been compromised in any way. As you might guess, these messages have a malicious attachment.

From:     Kifilwe Shakong [kshakong@cashbuild.co.za]
Date:     16 September 2014 12:17
Subject:     Copied invoices

The attached invoices are copies. We will not be able to pay them. Please send clear invoices
______________________________________________________________________
This outbound email has been scanned by the IS Mail Control service.
For more information please visit http://www.is.co.za
______________________________________________________________________

The attached invoices are copies. We will not be able to pay them. Please send clear invoices
______________________________________________________________________
This outbound email has been scanned by the IS Mail Control service.
For more information please visit http://www.is.co.za

Attached is a file with a filename in the format SKMBT_75114091015230.zip which in turn contains a malicious executable SKMBT_75114091015230.exe which has a very low detection rate at VirusTotal of just 1/54.

The ThreatTrack report [pdf] shows that the malware attempts to phone home to the following domains and IPs which are worth blocking:
golklopro.com
94.100.95.109
31.134.29.175
176.213.10.114
176.8.72.4
176.99.191.49
78.56.92.46
195.114.159.232
46.98.234.76
46.185.88.110
46.98.122.183
46.211.198.56
195.225.147.101
176.53.209.231

The payload seems to be very similar to this spam run yesterday.


UPDATE: The ThreatExpert report also indicates that the malware downloads components from the following locations:

musicacademymadras.in/333
ethostraining.es/333.cab
acfnet.com.br/333.jpg
vistabuys.com/333.exe

The malware attempts to phone home to cosjesgame.su as well as golklopro.com.

The ThreatTrack report [pdf] for the second component shows the malware attempting to POST to
37.59.136.101 (OVH, France alloced to "Varts Hosting GB") and 184.106.64.151 (Rackspace, US).

Recommended blocklist:
golklopro.com
cosjesgame.su
musicacademymadras.in
ethostraining.es
acfnet.com.br
vistabuys.com
31.134.29.175
37.59.136.101
46.98.234.76
46.98.122.183
46.119.126.141
46.185.88.110
46.211.198.56
77.121.236.75
78.56.92.46
85.237.34.129
91.221.29.181
93.78.145.22
93.183.242.24
94.100.95.109
107.23.255.195
109.165.101.8
176.8.72.4
176.53.209.231
176.99.191.49
176.193.54.38
176.213.10.114
178.74.216.27
178.137.18.149
184.106.64.151
195.114.159.232
195.138.84.68
195.225.147.101