[Dshield] new trojan - port 901 spike

Johannes B. Ullrich jullrich at sans.org
Thu Jun 5 17:15:28 GMT 2003

On Thu, 2003-06-05 at 09:03, Joe Stewart wrote:
> On Wednesday 04 June 2003 08:10 pm, Johannes B. Ullrich wrote:
> > I just put up a quick draft of a writeup explaining
> > the recent surge in port 901:
> >
> > http://isc.sans.org/diary.html?date=2003-06-04
> The writeup is a little unclear... it sounds as if NetDevil has to be 
> listening on port 901, and then the attacker uploads... NetDevil?

yes. the main problem we have so far is that the uploaded binary isn't
working right. Probably a test/beta version. Have to see what it will
evolve into.

More information about the list mailing list