|
|
We can proudly
present our portlist. The most complete, most correct portlist
ever. We update this list on a regular base, so check back
every week or so. Note: some of the more advanced
trojans let the hacker choose which port is being used. Here
only the defaults are given.
| Port |
Trojan Name |
Protocol |
| 9 |
Chargen |
UDP |
| 21 |
Back
Construction |
TCP |
|
Blade
Runner |
TCP |
|
Doly
Trojan |
TCP |
|
Fore |
TCP |
|
Invisible
FTP |
TCP |
|
FTP -
trojan |
TCP |
|
Larva |
TCP |
|
WebEx |
TCP |
|
WinCrash |
TCP |
| 23 |
Tiny
Telnet Server |
TCP |
| 25 |
Ajan |
TCP |
|
Antigen |
TCP |
|
Email
password sender |
TCP |
|
Haebu
Coceda |
TCP |
|
Happy
99 |
TCP |
|
Kuang2 |
TCP |
|
Promail
Trojan |
TCP |
|
Shtrilitz |
TCP |
|
Stealth |
TCP |
|
Tapiras |
TCP |
|
Terminator |
TCP |
|
WinPC |
TCP |
|
WinSpy |
TCP |
| 31 |
Hackers
Paradise |
TCP |
|
Master
Paradise |
TCP |
|
Agent
31 |
TCP |
| 41 |
Deep
Throat |
TCP |
| 53 |
DNS |
TCP |
| 58 |
DMsetup |
TCP |
| 79 |
Firehotcker |
TCP |
| 80 |
Executor |
TCP |
|
RingZero |
TCP |
| 99 |
Hidden
Port |
TCP |
| 110 |
Promail
Trojan |
TCP |
| 113 |
Kazimas |
TCP |
| 119 |
Happy
99 |
TCP |
| 121 |
JammerKillah |
TCP |
| 129 |
Password
Generator Protocol |
TCP |
| 135 |
Winnuke
(no trojan, nuker) |
TCP |
| 137 |
Netbios
name (DoS
attacks) |
TCP |
| 138 |
Netbios
datagram (DoS
attacks) |
TCP |
| 139 |
Winnuke
(no trojan, nuker) |
TCP |
|
Netbios
session (DoS
attacks) |
TCP |
| 421 |
TCP
Wrappers |
TCP |
| 456 |
Hackers
Paradise |
TCP |
| 531 |
Rasmin |
TCP |
| 555 |
iNi
- Killer |
TCP |
|
NetAdmin |
TCP |
|
Phase
Zero |
TCP |
|
Stealth
Spy |
TCP |
| 666 |
Attack
FTP |
TCP |
|
Cain
& Abel |
TCP |
|
Back
Construction |
TCP |
|
Satanz
Backdoor |
TCP |
|
ServeU |
TCP |
|
Shadow
Phyre |
TCP |
| 911 |
Dark
Shadow |
TCP |
| 999 |
Deep
Throat |
TCP |
|
WinSatan |
TCP |
| 1001 |
Silencer |
TCP |
|
WebEx |
TCP |
| 1010 |
Doly
trojan 1.35 |
TCP |
| 1011 |
Doly
trojan |
TCP |
| 1012 |
Doly
trojan |
TCP |
| 1015 |
Doly
trojan 1.5 |
TCP |
| 1024 |
NetSpy |
TCP |
| 1027 |
ICQ
(http://www.mirabilis.com/) |
TCP |
| 1029 |
ICQ
(http://www.mirabilis.com/) |
TCP |
| 1032 |
ICQ
(http://www.mirabilis.com/) |
TCP |
| 1033 |
Netspy |
TCP |
| 1042 |
Bla
1.1 |
TCP |
| 1045 |
Rasmin |
TCP |
| 1080 |
Wingate
(Socks-Proxy) |
TCP |
| 1090 |
Xtreme |
TCP |
| 1095 |
Rat |
TCP |
| 1097 |
Rat |
TCP |
| 1098 |
Rat |
TCP |
| 1099 |
Rat |
TCP |
| 1170 |
Psyber
Streaming Server |
TCP |
|
Voice
-Streaming Audio Trojan |
TCP |
| 1234 |
Ultors
Trojan |
TCP |
| 1243 |
Subseven |
TCP |
| 1245 |
VooDoo
Doll |
TCP |
| 1269 |
Maverick's Matrix |
TCP |
| 1349 |
Back
Orifice DLL |
UDP |
| 1492 |
FTP99CMP |
TCP |
| 1509 |
Psyber
Streaming Server |
TCP |
| 1600 |
Shivka -
Burka |
TCP |
| 1807 |
SpySender |
TCP |
| 1981 |
Shockrave |
TCP |
| 1999 |
BackDoor |
TCP |
|
TransScout |
TCP |
| 2000 |
TransScout |
TCP |
| 2001 |
TransScout |
TCP |
|
Trojan
Cow |
TCP |
| 2002 |
TransScout |
TCP |
| 2003 |
TransScout |
TCP |
| 2004 |
TransScout |
TCP |
| 2005 |
TransScout |
TCP |
| 2023 |
Pass
Ripper |
TCP |
| 2115 |
Bugs |
TCP |
| 2140 |
Deep
Throat |
TCP |
|
The
Invasor |
TCP |
| 2155 |
Illusion
Mailer |
TCP |
| 2283 |
HVL Rat
5 |
TCP |
| 2565 |
Striker |
TCP |
| 2583 |
WinCrash |
TCP |
| 2600 |
Digital
RootBeer |
TCP |
| 2801 |
Phineas
Phucker |
TCP |
| 2989 |
Rat |
UDP |
| 3024 |
WinCrash |
TCP |
| 3128 |
RingZero |
TCP |
| 3129 |
Masters
Paradise |
TCP |
| 3150 |
Deep
Throat |
TCP |
|
The
Invasor |
TCP |
| 3459 |
Eclipse
2000 |
TCP |
| 3700 |
Portal
of Doom |
TCP |
| 3791 |
Eclypse |
TCP |
| 3801 |
Eclypse |
UDP |
| 4092 |
WinCrash |
TCP |
| 4321 |
BoBo |
TCP |
| 4567 |
File
Nail |
TCP |
| 4590 |
ICQTrojan |
TCP |
| 5000 |
Sockets
de Troie |
TCP |
|
Bubbel |
TCP |
|
Back Door
Setup |
TCP |
|
Socket23 |
TCP |
| 5001 |
Sockets
de Troie |
TCP |
|
Back Door
Setup |
TCP |
| 5011 |
One
of the Last Trojans (OOTLT) |
TCP |
| 5031 |
NetMetro |
TCP |
| 5321 |
Firehotcker |
TCP |
| 5400 |
Blade
Runner |
TCP |
|
BackConstruction 1.2 |
TCP |
| 5401 |
Blade
Runner |
TCP |
| 5402 |
Blade
Runner |
TCP |
| 5512 |
Illusion
Mailer |
TCP |
| 5550 |
Xtcp |
TCP |
| 5555 |
ServeMe |
TCP |
| 5556 |
BO
Facil |
TCP |
| 5557 |
BO
Facil |
TCP |
| 5569 |
Robo -
Hack |
TCP |
| 5742 |
WinCrash |
TCP |
| 6400 |
tHe
tHing |
TCP |
| 6669 |
Vampyre |
TCP |
| 6670 |
Deep
Throat |
TCP |
| 6674 |
Deep
Throat |
TCP |
| 6711 |
Subseven |
TCP |
| 6771 |
Deep
Throat |
TCP |
| 6776 |
Subseven |
TCP |
| 6883 |
DeltaSource |
UDP |
| 6912 |
ShitHeap |
TCP |
| 6939 |
Indoctrination |
TCP |
| 6969 |
GateCrasher |
TCP |
|
IRC
3 |
TCP |
|
Priority |
TCP |
| 6970 |
GateCrasher |
TCP |
| 7000 |
Remote
Grab |
TCP |
|
Kazimas |
TCP |
| 7300 |
Netmonitor |
TCP |
| 7301 |
Netmonitor |
TCP |
| 7306 |
Netmonitor |
TCP |
| 7307 |
Netmonitor |
TCP |
| 7308 |
Netmonitor |
TCP |
| 7789 |
ICKiller |
TCP |
|
Back Door
Setup |
TCP |
| 8080 |
RingZero |
TCP |
| 9400 |
InCommand |
TCP |
| 9872 |
Portal
of Doom |
TCP |
| 9873 |
Portal
of Doom |
TCP |
| 9874 |
Portal
of Doom |
TCP |
| 9875 |
Portal
of Doom |
TCP |
| 9876 |
Cyber
Attacker |
TCP |
| 9878 |
TransScout |
TCP |
| 9989 |
iNi
- Killer |
TCP |
| 10067 |
Portal
of Doom |
TCP |
| 10101 |
BrainSpy |
TCP |
| 10167 |
Portal
of Doom |
UDP |
| 10520 |
Acid
Shivers |
TCP |
| 10607 |
Coma |
TCP |
| 11000 |
Senna Spy
Trojans |
TCP |
| 11223 |
Progenic
Trojan |
TCP |
| 12076 |
Gjamer |
TCP |
| 12223 |
Hack '99
Keylogger |
TCP |
| 12345 |
GabanBus |
TCP |
|
Netbus
1.x |
TCP |
|
Pie Bill
Gates |
TCP |
|
X -
Bill |
TCP |
| 12346 |
GabanBus |
TCP |
|
Netbus
1.x (avoiding NetBuster) |
TCP |
|
X -
Bill |
TCP |
| 12361 |
Whack-a-mole |
TCP |
| 12362 |
Whack-a-mole |
TCP |
| 12631 |
WhackJob |
TCP |
| 13000 |
Senna Spy
Trojans |
TCP |
| 16969 |
Priority |
TCP |
| 17300 |
Kuang2
theVirus |
TCP |
| 20000 |
Millenium |
TCP |
| 20001 |
Millenium |
TCP |
| 20034 |
Netbus
2 Pro |
TCP |
| 20203 |
Logged |
TCP |
| 20331 |
Bla |
TCP |
| 21554 |
Girlfriend |
TCP |
|
Schwindler 1.82 |
TCP |
| 22222 |
Prosiak |
TCP |
| 23456 |
Evil
FTP |
TCP |
|
Ugly
FTP |
TCP |
|
WhackJob |
TCP |
| 23476 |
Donald
Dick |
TCP |
| 23477 |
Donald
Dick |
TCP |
| 26274 |
Delta
Source |
UDP |
| 29891 |
The
Unexplained |
UDP |
| 30029 |
AOLTrojan |
TCP |
| 30100 |
NetSphere
1.27a, 1.29, 1.31 |
TCP |
| 30101 |
NetSphere
1.27a, 1.29, 1.31 |
TCP |
| 30102 |
NetSphere
1.27a, 1.29, 1.31 |
TCP |
| 30103 |
NetSphere
1.31 |
TCP |
| 30303 |
Socket25 |
TCP |
|
Sockets
De Troie |
TCP |
| 30999 |
Kuang |
TCP |
| 31336 |
BOWhack |
TCP |
| 31337 |
Back
Orifice |
TCP /
UDP |
|
Back
Fire |
UDP |
|
DeepBO |
UDP |
|
BO
Facil |
TCP |
|
Baron
Night |
TCP |
| 31338 |
Back
Orifice |
UDP |
|
DeepBO |
UDP |
|
NetSpy
DK |
TCP |
| 31339 |
NetSpy
DK |
TCP |
| 31666 |
BOWhack |
TCP |
| 31780 |
Hack'a'Tack |
TCP |
| 31785 |
Hack'a'Tack |
TCP |
| 31787 |
Hack'a'Tack |
TCP |
| 31788 |
Hack'a'Tack |
TCP |
| 31789 |
Hack'a'Tack |
UDP |
| 31790 |
Hack'a'Tack |
TCP |
| 31791 |
Hack'a'Tack |
UDP |
| 31792 |
Hack'a'Tack |
TCP |
| 33333 |
Prosiak |
TCP |
| 33911 |
Trojan
Spirit 2001 a |
TCP |
| 34324 |
BigGluck
(aka TN) |
TCP |
|
Tiny
Telnet Server |
TCP |
| 40412 |
The
Spy |
TCP |
| 40421 |
Masters
Paradise |
TCP |
|
Agent
40421 |
TCP |
| 40422 |
Masters
Paradise |
TCP |
| 40423 |
Masters
Paradise |
TCP |
| 40425 |
Masters
Paradise |
TCP |
| 40426 |
Masters
Paradise |
TCP |
| 47262 |
Delta
Source |
UDP |
| 50505 |
Sockets
de Troie |
TCP |
| 50766 |
Fore |
TCP |
|
Schwindler |
TCP |
| 53001 |
Remote
Windows Shutdown |
TCP |
| 54320 |
Back
Orifice 2000 |
TCP
default |
| 54321 |
Back
Orifice 2000 |
UDP
default |
|
Schoolbus |
TCP |
| 60000 |
Deep
Throat |
TCP |
| 61466 |
Telecommando |
TCP |
| 65000 |
Devil |
TCP |
|