New Western Union spam with Trojan in the wild

Since late last week, we have been observing a fair number of spams with a Trojan payload, purporting to be a money transfer notification from Western Union. The spam looks like this (the attachment in this screenshot has been stripped by a scanner -- the actual attachment should read "Western Union Information.exe":

Westernunion123888

The text may read something like this:

or

Dear Mike

The payload is Trojan.Perfloger (there are many other descriptions. A VirusTotal scan is here).

After the Trojan is executed, the user sees a text file:

Capture1231231238888

But that, of course, is the least of their problems.

An analysis of the program is on the Sunbelt Sandbox, here.