Whose port is it anyway?

Here’s a small listing of some kits and what tcp ports they have been using lately. Consider them to be a snapshot of the past 30 days as these are likely to change.

Neutrino EK

:8000/andhbdthgqofr?qdirmw=5283539
:8000/agqfhdo?qlpqjbjvlmud=8201532
:8000/atmjrsds?qgtkrdmghtro=403906

Cool/Styx

@Kafeine has a great in-depth look at this activity at http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html

:754/grateful_partly-panic.html
:754/dissipate-favourite_timing_breath.jar
:754/tshirt_spot.htm

Sakura EK

:38/mark-two_learn.php
:38/weather-begin.php

:443/pages/see.php
:443/pages/its.php
:443/pages/see.php

:52/against.php
:52/produce.php
:52/gone.php

:90/docs/sky.php
:90/docs/space.php

:9090/nothing.php
:9090/nothing.php

:96/docs/at.php
:96/docs/land.php

Sweet Orange EK

:6091/full/contrib/foodsites.php?amazon=82
:6091/profiles/foodsites.php?amazon=82
:6091/bbadmin/acct_login/clickheat/foodsites.php?amazon=82

:3811/vadmind/install.php?virus=221&demos=82&changes=745&pages=379&bugs=798&mapa=203
:3811/stores/competition/ladder/tramadol.php?plugins=33&promos=246&about_us=135&email=499&chapters=82&vote=336&export=225
:3811/upload/loginflat/partners.php?navbar=350&faculty=613&ports=82&training=627&generic=975&experts=19&giftsjob=865

:7149/ajax/internal/campaign.php?readme=454&story=384&voip=831&fonts=82&top_left=610

Glazunov EK

:8080/4856827694/8385.zip
:8080/3819449304/8.zip
:8080/3335683362/2295.zip

Sibhost EK

:85/ipy2nCAsCEymbrnYg0TC2V6lVgn4
:85/I26mpxrs5r0L8XLTyxJXIAHI6J1XyPtjEpLY1.zip

Comments are closed.