|
Port 37885 Details
known port assignments and vulnerabilities
threat/application/port search:
| Port(s) |
Protocol |
Service |
Details |
Source |
| 37885 |
tcp |
malware |
Backdoor.Win32.Kwak.12 / Remote Command Execution - the backdoor runs an FTP server that listens on TCP port 37885. The malware is packed using UPX which is trivial to unpack by using upx -d command, after observe various FTP commands supported using strings util, we find one interesting string entry named "execute". Turns out this will let us execute any command on the infected machine. Third-party adversaries can add a persistent backdoor account on the infected system or run any command they wish. This is easily accomplished as the malware also suffers from a authentication bypass issue reference MVID-2021-0147.
References: [MVID-2021-0149]
Backdoor.Win32.Kwak.12 / Authentication Bypass - the backdoor runs an FTP server that listens on TCP port 37885. The program acts like a typical FTP server and prompts for logon. However, anyone can seemingly use any combination of username and password to logon to the system and run commands.
References: [MVID-2021-0147]
Backdoor.Win32.Kwak.12 / Remote Denial of Service - the backdoor runs an FTP server that listens on TCP port 37885. Attackers who can reach the infected host can send a payload of around 6500 bytes using socket program to cause an unknown internal exception to crash the malware.
References: [MVID-2021-0146] |
SG
|
| 37655-37999 |
tcp,udp |
|
Unassigned |
IANA
|
|
2 records found
|