December 11 2017 EMOTET Phish Awaiting for your confirmation

SMTP Sender IP: 40[.]92[.]67[.]78

From: merve_genc88[@]hotmail[.]com
Subject: Awaiting for your confirmation

Phishing Link: hxxp://cn[.]mediplus-orders[.]jp/45504/
Doc Dropper: Awaiting for your confirmation.doc
SHA256 Hash: 47c3380817d266792f6ffea49ad8645c2d74446554155af4b04eaa2a0753daaa

Emotet Download:
hxxp://dota-store[.]ru/KsqcR1V/
hxxp://karpetmurah[.]net/hJ3ap/
hxxp://pittmans[.]ca/kpJJ/
hxxp://greencarpetpbc[.]com/pTKsoL/
hxxp://www[.]severingroup[.]ru/QV0PddQ/

C2:
hxxps://62[.]210[.]187[.]97