|
Port 1250 Details
known port assignments and vulnerabilities
threat/application/port search:
| Port(s) |
Protocol |
Service |
Details |
Source |
| 1250 |
tcp |
worms |
W32.Explet.A@mm [Symantec-2004-060219-4511-99] (2004.06.02) - a mass-mailing worm that also spreads through network shares and the Kazaa file-sharing network. The worm exploits the Microsoft Windows LSASS Buffer Overrun Vulnerability (described in Microsoft Security Bulletin [MS04-011]) and the DCOM RPC vulnerability (described in Microsoft Security Bulletin [MS03-026]) through TCP ports 135 and 445. It may also lower security settings and download remote files.
Email-Worm.Win32.Plexus.b / Unauthenticated Remote Code Execution - the malware listens on TCP ports 1250 (file write port) and 47435 (random FTP port). Third-party attackers who can reach infected systems can use a socket program to write binary data to the remote host. The malware then writes that data to a file named "_up.exe" under
"\Users\Victim\AppData\Local\Temp" that executes immediately.
References: [MVID-2021-0400]
swldy-sias (IANA official). |
SG
|
| 1250 |
tcp |
threat |
W32.Explet |
Bekkoame
|
| 1250 |
tcp,udp |
swldy-sias |
swldy-sias |
IANA
|
|
3 records found
|