Ports used by trojans (1999-06-20) 
    

The table shows examples of existing trojans and ports being used. The lower ports are often used by trojans that steals password and either mail the passwords to attackers or hide them in FTP-directories. The higher ports are often used by Remote Access trojans that can be reached over the network. 

The problem with Remote Access trojans or trojans trying to steal passwords is fairly new. Today there are no programs, antivirus or antitrojan programs, which can detect unknown trojan horses. The programs claiming to defend you can usually only find a fraction of all the trojans out there. 

This list was updated 1999-06-20 and includes more than 60 new entries compared with the previous version. 

The table have been compiled by Joakim von Braun (von Braun Consultants), who also answers any questions. 

Default ports used by some known trojan horses: 

port 21 - Blade Runner, Doly Trojan, Fore, FTP trojan, Invisible FTP, Larva, WebEx, WinCrash 
port 23 - Tiny Telnet Server 
port 25 - Antigen, Email Password Sender, Haebu Coceda, Kuang2, ProMail trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy 
port 31 - Agent 31, Hackers Paradise, Masters Paradise 
port 41 - DeepThroat 
port 58 - DMSetup 
port 79 - Firehotcker 
port 80 - Executor 
port 110 - ProMail trojan 
port 121 - JammerKillah 
port 421 - TCP Wrappers 
port 456 - Hackers Paradise 
port 531 - Rasmin 
port 555 - Ini-Killer, Phase Zero, Stealth Spy 
port 666 - Attack FTP, Satanz Backdoor 
port 911 - Dark Shadow 
port 999 - DeepThroat 
port 1001 - Silencer, WebEx 
port 1011 - Doly Trojan 
port 1012 - Doly Trojan 
port 1024 - NetSpy 
port 1045 - Rasmin 
port 1090 - Xtreme 
port 1170 - Psyber Stream Server, Voice 
port 1234 - Ultors Trojan 
port 1243 - BackDoor-G, SubSeven 
port 1245 - VooDoo Doll 
port 1349 (UDP) - BO DLL 
port 1492 - FTP99CMP 
port 1600 - Shivka-Burka 
port 1807 - SpySender 
port 1981 - Shockrave 
port 1999 - BackDoor 
port 2001 - Trojan Cow 
port 2023 - Ripper 
port 2115 - Bugs 
port 2140 - Deep Throat, The Invasor 
port 2565 - Striker 
port 2583 - WinCrash 
port 2801 - Phineas Phucker 
port 3024 - WinCrash 
port 3129 - Masters Paradise 
port 3150 - Deep Throat, The Invasor 
port 3700 - Portal of Doom 
port 4092 - WinCrash 
port 4567 - File Nail 
port 4590 - ICQTrojan 
port 5000 - Bubbel, Back Door Setup, Sockets de Troie 
port 5001 - Back Door Setup, Sockets de Troie 
port 5321 - Firehotcker 
port 5400 - Blade Runner 
port 5401 - Blade Runner 
port 5402 - Blade Runner 
port 5555 - ServeMe 
port 5556 - BO Facil 
port 5557 - BO Facil 
port 5569 - Robo-Hack 
port 5742 - WinCrash 
port 6400 - The Thing 
port 6670 - DeepThroat 
port 6771 - DeepThroat 
port 6776 - BackDoor-G, SubSeven 
port 6939 - Indoctrination 
port 6969 - GateCrasher, Priority 
port 7000 - Remote Grab 
port 7300 - NetMonitor 
port 7301 - NetMonitor 
port 7306 - NetMonitor 
port 7307 - NetMonitor 
port 7308 - NetMonitor 
port 7789 - Back Door Setup, ICKiller 
port 9872 - Portal of Doom 
port 9873 - Portal of Doom 
port 9874 - Portal of Doom 
port 9875 - Portal of Doom 
port 9989 - iNi-Killer 
port 10067 - Portal of Doom 
port 10167 - Portal of Doom 
port 10520 - Acid Shivers 
port 10607 - Coma 
port 11000 - Senna Spy 
port 11223 - Progenic trojan 
port 12223 - Hack´99 KeyLogger 
port 12345 - GabanBus, NetBus, Pie Bill Gates, X-bill 
port 12346 - GabanBus, NetBus, X-bill 
port 12361 - Whack-a-mole 
port 12362 - Whack-a-mole 
port 12631 - WhackJob 
port 13000 - Senna Spy 
port 16969 - Priority 
port 20001 - Millennium 
port 20034 - NetBus 2 Pro 
port 21544 - GirlFriend 
port 22222 - Prosiak 
port 23456 - Evil FTP, Ugly FTP 
port 26274 (UDP) - Delta Source 
port 29891 (UDP) - The Unexplained 
port 30029 - AOL Trojan 
port 30100 - NetSphere 
port 30101 - NetSphere 
port 30102 - NetSphere 
port 30303 - Sockets de Troie 
port 31337 - Baron Night, BO client, BO2, Bo Facil 
port 31337 (UDP) - BackFire, Back Orifice, DeepBO 
port 31338 - NetSpy DK 
port 31338 (UDP) - Back Orifice, DeepBO 
port 31339 - NetSpy DK 
port 31666 - BOWhack 
port 33333 - Prosiak 
port 34324 - BigGluck, TN 
port 40412 - The Spy 
port 40421 - Agent 40421, Masters Paradise 
port 40422 - Masters Paradise 
port 40423 - Masters Paradise 
port 40426 - Masters Paradise 
port 47262 (UDP) - Delta Source 
port 50505 - Sockets de Troie 
port 50766 - Fore 
port 53001 - Remote Windows Shutdown 
port 54321 - School Bus 
port 60000 - Deep Throat 
port 61466 - Telecommando 
port 65000 - Devil 

If you have any questions or information about actual trojan attacks or ports used by trojans not listed above, please contact Joakim von Braun. 

Copyright von Braun Consultants and Simovits Consulting. The above text may be cited provided that the source of the information is acknowledged.