Ports Malware C2#
Ports historically observed in malware and C2 traffic. The operator uses this list when triaging suspicious flows, tuning sensors, or selecting non-attributable callback ports for offensive infrastructure.
Ports#
Port |
Actor / Family |
|---|---|
21 |
Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash |
23 |
Tiny Telnet Server |
25 |
Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2.0 |
31 |
Hackers Paradise |
80 |
Executor |
127 |
TYPEFRAME |
456 |
Hackers Paradise |
465 |
Zebrocy |
555 |
Ini-Killer, Phase Zero, Stealth Spy |
587 |
AgentTesla |
587 |
Cannon |
666 |
Satanz Backdoor |
995 |
RedLeaves |
1001 |
Silencer, WebEx |
1011 |
Doly Trojan |
1058 |
Bankshot |
1170 |
Psyber Stream Server, Voice |
1234 |
Ultors Trojan |
1243 |
SubSeven 1.0-1.8 |
1245 |
VooDoo Doll |
1349 |
Back Ofrice DLL |
1492 |
FTP99CMP |
1600 |
Shivka-Burka |
1807 |
SpySender |
1981 |
Shockrave |
1999 |
BackDoor 1.00-1.03 |
2001 |
Trojan Cow |
2023 |
Ripper |
2115 |
Bugs |
2140 |
Deep Throat, The Invasor |
2801 |
Phineas Phucker |
3024 |
WinCrash |
3129 |
Masters Paradise |
3150 |
Deep Throat, The Invasor |
3333 |
RevengeRAT |
3700 |
Portal of Doom |
3728 |
MobileOrder |
4092 |
WinCrash |
4567 |
File Nail 1 |
4590 |
ICQTrojan |
5000 |
Bubbel |
5001 |
Sockets de Troie |
5321 |
Firehotcker |
5400 |
Blade Runner 0.80 Alpha |
5400 |
Blade Runner |
5401 |
Blade Runner 0.80 Alpha |
5401 |
Blade Runner |
5402 |
Blade Runner 0.80 Alpha |
5402 |
Blade Runner |
5569 |
Robo-Hack |
5742 |
WinCrash |
6666 |
GorgonGroup |
6670 |
DeepThroat |
6771 |
DeepThroat |
6969 |
GateCrasher, Priority |
7000 |
Remote Grab |
7300 |
NetMonitor |
7301 |
NetMonitor |
7306 |
NetMonitor |
7307 |
NetMonitor |
7308 |
NetMonitor |
7789 |
ICKiller |
8088 |
Volgmer |
8787 |
BackOrifice 2000 |
9872 |
Portal of Doom |
9873 |
Portal of Doom |
9874 |
Portal of Doom |
9875 |
Portal of Doom |
9989 |
iNi-Killer |
10067 |
Portal of Doom |
10167 |
Portal of Doom |
10607 |
Coma 1.0.9 |
11000 |
Senna Spy |
11223 |
Progenic trojan |
12223 |
Hack99 KeyLogger |
12345 |
GabanBus, NetBus |
12346 |
GabanBus, NetBus |
12361 |
Whack-a-mole |
12362 |
Whack-a-mole |
13000 |
Remsec |
14146 |
APT32 |
16969 |
Priority |
20001 |
Millennium |
20034 |
NetBus 2.0, Beta-NetBus 2.01 |
21544 |
GirlFriend 1.0, Beta-1.35 |
22222 |
Prosiak |
23456 |
Evil FTP, Ugly FTP |
26274 |
Delta |
30100 |
NetSphere 1.27a |
30101 |
NetSphere 1.27a |
30102 |
NetSphere 1.27a |
31337 |
Back Orifice |
31337 |
BackOfice 1.20 |
31338 |
Back Orifice, DeepBO |
31338 |
DeepBO |
31339 |
NetSpy DK |
31666 |
BOWhack |
33333 |
Prosiak |
34324 |
BigGluck, TN |
40412 |
The Spy |
40421 |
Masters Paradise |
40422 |
Masters Paradise |
40423 |
Masters Paradise |
40426 |
Masters Paradise |
46769 |
GravityRAT |
47262 |
Delta |
50505 |
Sockets de Troie |
50766 |
Fore |
53001 |
Remote Windows Shutdown |
54321 |
SchoolBus .69-1.11 |
54321 |
BackOfice 2000 |
61061 |
HiddenWasp |
61466 |
Telecommando |
65000 |
Devil |
1177:8282 |
njRAT |
1913:81 |
APT3 |
1985:1986 |
ZxShell |
2280:1339 |
CoinTicker |
4443:3543 |
MagicHound |
4444:8531:50501 |
TEMP.Veles |
447:449:8082 |
TrickBot |
52100:5876 |
InnaputRAT |
6666:4782 |
NanoCore |
6868:7777 |
PoisonIvy |
7080:50000 |
Emotet |
8060:8888 |
POWERSTATS |
808:880 |
APT33 |
8081:8282:8083 |
Group5 |
995:1816:465:1521:3306 |
LazarusGroup |