Re: Odd scans of tcp port 12345

[shadoze () FREEWWWEB COM (Shadow Boxer)]

Russell Fulton wrote:

> Greetings,
>           Over the last 24 hours I have detected 4 scans of tcp ports
> 12345 in our /16 address space.  What is odd about these scans is that
> *all* started at address 11 and then the scan probed sequentially
> upwards until it got to 255 (except in one case where it stopped at
> 100).  There is 5 seconds between connection attempts suggesting a loop
> trying standard tcp connects rather than a tool like nmap.
>
> The source addresses were all major ISPs one in UK, one in Korea and
> two in US -- all have been notified.
>
> There are several trojans that are known to have 12345 as a default
> remote control port but these scans don't seem (to me anyway) to be
> someone using nmap (or other standard tool) looking trojans.  It seems
> more likely that this is a worm that is trying to spread through
> machines that have been compromised by some trojan.  Why start at
> address 11? May be it is a typo for '1' in the script?
>
> Cheers, Russell.

Well, I think the prospect of a worm may be jumping to conclusions a bit
quickly.  A lot of trojans have built in scanners that could be causing
this.  Also, there are trojan scanners that scan for certain trojans on a
set ip block.  I believe some of these use standart tcp connections.