nerdexam
GIAC

GCIH · Question #72

You enter the netstat -an command in the command prompt and you receive intimation that port number 7777 is open on your computer. Which of the following Trojans may be installed on your computer?

The correct answer is D. Tini. Different Trojans listen on well-known default ports, and port 7777 is specifically associated with the Tini backdoor Trojan.

Malware Analysis & Advanced Persistent Threats

Question

You enter the netstat -an command in the command prompt and you receive intimation that port number 7777 is open on your computer. Which of the following Trojans may be installed on your computer?

Options

  • ANetBus
  • BQAZ
  • CDonald Dick
  • DTini

How the community answered

(43 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    91% (39)

Why each option

Different Trojans listen on well-known default ports, and port 7777 is specifically associated with the Tini backdoor Trojan.

ANetBus

NetBus is a remote administration Trojan that listens on ports 12345 and 12346 by default, not port 7777.

BQAZ

QAZ is a Trojan that uses port 7597 as its default listening port and is known for spreading via the Notepad replacement technique, not port 7777.

CDonald Dick

Donald Dick is a backdoor Trojan associated with ports 23476 and 23477, not port 7777.

DTiniCorrect

Tini is a minimal Windows backdoor Trojan that binds a command shell to port 7777/TCP, allowing an attacker to remotely execute commands on the compromised host - its use of port 7777 is a well-documented indicator of compromise used in CEH and forensic analysis curricula.

Concept tested: Trojan identification by default listening port

Topics

#Trojan port signatures#Tini backdoor#netstat enumeration#backdoor detection

Community Discussion

No community discussion yet for this question.

Full GCIH Practice