Re: !! Strange ports for attack

[Max Gribov <mgribov () KPLAB COM>]

12345 is netbus port.netbus is a trojan, allowing remote control/comman
execution on infected machine. other ports seem to be trojan ports as well,
though i cannot definetely confirm that.
this appears to be a trojan scan.
----- Original Message -----
From: Pavel Lozhkin <pauel () BALAKOVO RU>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Monday, August 14, 2000 1:44 AM
Subject: !! Strange ports for attack


> Does anyone know about TCP ports 17300,27374,1243,12346,12345 and
> exploits corresponding for these ports ?
>
> Connection attempt to TCP 195.161.130.240:17300 from 195.133.72.11:4088
> Connection attempt to TCP 195.161.130.240:27374 from 195.133.72.11:4089
> Connection attempt to TCP 195.161.130.240:1243 from 195.133.72.11:4090
> Connection attempt to TCP 195.161.130.240:12346 from 195.133.72.11:4091
> Connection attempt to TCP 195.161.130.240:12345 from 195.133.72.11:4092
>
> --
> ** The hedgehog is a proud bird, he does not fly without kick **
>
> Pauel
> System administrator
> ICQ UIN 39596913 8990192
> Phone (7-84570)-52525
>       (7-84570)-40658
>
> Unix is like a wigwam -- no Gates, no Windows, and an Apache inside.