Port 1166: QSM RemoteExec — The administrator's door that became a backdoor

Port 1166 is officially registered with IANA for qsm-remote, the network protocol used by QSM RemoteExec—legitimate enterprise software for remote Windows administration. But this port's story includes a darker chapter: exploitation by malware that recognized the same remote execution capabilities could serve different purposes.

What QSM RemoteExec Does

RemoteExec is a deployment tool for Windows networks. IT administrators use it to install software, run scripts, modify registry settings, and execute commands across hundreds or thousands of computers from a central location.¹

The legitimate use cases are straightforward:

• Deploy application updates to every workstation simultaneously
• Install security patches across an entire enterprise
• Execute maintenance scripts on remote servers
• Modify registry settings network-wide
• Remotely reboot or shutdown systems

The software works by accepting commands on port 1166 and executing them with the necessary privileges on the target machine. This is powerful when you need to deploy Microsoft Office to 500 computers. This is dangerous when someone else gains access to that same port.

The Backdoor Problem

Port 1166 has been associated with malware variants known as "Crazynet" and other backdoor trojans.² These weren't exploiting a vulnerability in RemoteExec—they were simply using the same port number for their own remote access capabilities.

When malware listens on port 1166, it can:

• Accept commands from a remote attacker
• Execute arbitrary code with system privileges
• Maintain persistent access to the compromised system
• Potentially spread to other systems on the network

The irony: the malware does essentially what RemoteExec does, just without authorization.

The Registered Port Range

Port 1166 sits in the registered port range (1024-49151). These ports are assigned by IANA to specific services upon application by software vendors. Unlike well-known ports (0-1023), registered ports don't require root/administrator privileges to bind to, which makes them accessible to regular applications—and to malware.

The registration tells you what should be using the port. It doesn't tell you what is using the port on your network.

Security Considerations

If you see traffic on port 1166, ask:

• Do we actually use QSM RemoteExec?
• If yes, is this traffic coming from our legitimate management server?
• If no, why is something listening on this port?

For administrators using RemoteExec:

• Restrict port 1166 access using firewalls—only management servers should connect
• Monitor for unexpected connections from unknown sources
• Authenticate and encrypt all remote execution commands
• Log all remote execution activity for audit purposes

For everyone else:

• If you're not using RemoteExec, nothing should be listening on port 1166
• Block incoming connections to this port at your firewall
• Scan systems regularly for unauthorized services

How to Check What's Listening

Windows:

netstat -ano | findstr :1166

Linux/macOS:

lsof -i :1166
netstat -an | grep 1166

If something is listening and you don't know why, investigate. Legitimate RemoteExec installations should be documented in your IT asset inventory. Unknown listeners could be malware.

The Dual Nature of Remote Execution

Port 1166 represents something fundamental about networked systems: the tools that make administration possible also make exploitation possible. Remote execution is powerful precisely because it gives complete control. Whether that control serves legitimate purposes depends entirely on who's sending the commands.

The port itself is neutral. The protocol is neutral. The software can be legitimate or malicious. The same door serves both purposes.

Related Ports

• Port 135 - Microsoft RPC, another remote procedure call mechanism
• Port 445 - SMB/CIFS, often used for remote file access and administration
• Port 3389 - Remote Desktop Protocol (RDP), interactive remote access
• Port 5985/5986 - WinRM, Windows Remote Management