TCP Port 27374

Common Use

Used by the SubSeven trojan (and others).

Inbound Traffic

These are typically scans for systems infected with SubSeven and other RATs (Remote Access Trojans).  These trojans are often installed as the result of the user running infected email or newsgroup attachments, or running otherwise infected files.  SubSeven is one of the most popular RATs in the hacker community as it is very powerful and can allow a remote user to do pretty well anything with the compromised system that you could do sitting in front of the keyboard.

Outbound Traffic

Outbound scans if occurring in volume should be considered an indication of a possible infection or compromise on the source computer and should be investigated immediately.

Additional Information

Page last updated on February 09, 2004