A list of common ports used by trojans.
List of Ports generally used by Trojans | TCP Port | Name of Trojan | | 21 | Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx, WinCrash | | 23 | Tiny Telnet Server | | 25 | Antigen, Email Password Sender, Haebu Coceda, Shtrilitz Stealth, Terminator, WinPC, WinSpy, Kuang2 0.17A-0.30 | | 31 | Hackers Paradise | | 80 | Executor | | 456 | Hackers Paradise | | 555 | Ini-Killer, Phase Zero, Stealth Spy | | 666 | Satanz Backdoor | | 1001 | Silencer, WebEx | | 1011 | Doly Trojan | | 1170 | Psyber Stream Server, Voice | | 1234 | Ultors Trojan | | 1243 | SubSeven 1.0 - 1.8 | | 1245 | VooDoo Doll | | 1492 | FTP99CMP | | 1600 | Shivka-Burka | | 1807 | SpySender | | 1981 | Shockrave | | 1999 | BackDoor 1.00-1.03 | | 2001 | Trojan Cow | | 2023 | Ripper | | 2115 | Bugs | | 2140 | Deep Throat, The Invasor | | 2801 | Phineas Phucker | | 3024 | WinCrash | | 3129 | Masters Paradise | | 3150 | Deep Throat, The Invasor | | 3700 | Portal of Doom | | 4092 | WinCrash | | 4567 | File Nail 1 | | 4590 | ICQTrojan | | 5000 | Bubbel | | 5000 | Sockets de Troie | | 5001 | Sockets de Troie | | 5321 | Firehotcker | | 5400 | Blade Runner 0.80 Alpha | | 5401 | Blade Runner 0.80 Alpha | | 5402 | Blade Runner 0.80 Alpha | | 5400 | Blade Runner | | 5401 | Blade Runner | | 5402 | Blade Runner | | 5569 | Robo-Hack | | 5742 | WinCrash | | 6670 | DeepThroat | | 6771 | DeepThroat | | 6969 | GateCrasher, Priority | | 7000 | Remote Grab | | 7300 | NetMonitor | | 7301 | NetMonitor | | 7306 | NetMonitor | | 7307 | NetMonitor | | 7308 | NetMonitor | | 7789 | ICKiller | | 8787 | BackOfrice 2000 | | 9872 | Portal of Doom | | 9873 | Portal of Doom | | 9874 | Portal of Doom | | 9875 | Portal of Doom | | 9989 | iNi-Killer | | 10067 | Portal of Doom | | 10167 | Portal of Doom | | 10607 | Coma 1.0.9 | | 11000 | Senna Spy | | 11223 | Progenic trojan | | 12223 | Hack´99 KeyLogger | | 12345 | GabanBus, NetBus | | 12346 | GabanBus, NetBus | | 12361 | Whack-a-mole | | 12362 | Whack-a-mole | | 16969 | Priority | | 20001 | Millennium | | 20034 | NetBus 2.0, Beta-NetBus 2.01 | | 21544 | GirlFriend 1.0, Beta-1.35 | | 22222 | Prosiak | | 23456 | Evil FTP, Ugly FTP | | 26274 | Delta | | 30100 | NetSphere 1.27a | | 30101 | NetSphere 1.27a | | 30102 | NetSphere 1.27a | | 31337 | Back Orifice | | 31338 | Back Orifice, DeepBO | | 31339 | NetSpy DK | | 31666 | BOWhack | | 33333 | Prosiak | | 34324 | BigGluck, TN | | 40412 | The Spy | | 40421 | Masters Paradise | | 40422 | Masters Paradise | | 40423 | Masters Paradise | | 40426 | Masters Paradise | | 47262 | Delta | | 50505 | Sockets de Troie | | 50766 | Fore | | 53001 | Remote Windows Shutdown | | 54321 | SchoolBus .69-1.11 | | 61466 | Telecommando | | 65000 | Devil |
| UDP Port | Name of Trojan | | 1349 | Back Ofrice DLL | | 31337 | BackOfrice 1.20 | | 31338 | DeepBO | | 54321 | BackOfrice 2000 | |
Security Blog 
