Port 1177: DKMessenger — The forgotten protocol and the trojan that moved in

Port 1177 sits in the registered port range (1024-49151), officially assigned to something called "DKMessenger Protocol" in November 2004¹. That's all anyone knows about DKMessenger. No documentation survives. No one remembers what it did or who created it. The protocol exists only as a line item in the IANA registry—a digital ghost.

What port 1177 became known for is something else entirely.

The Trojan That Moved In

While DKMessenger faded into obscurity, port 1177 became the preferred home of njRAT—a remote access trojan first discovered in 2012². Also known as Bladabindi, njRAT is what security researchers call a "commodity RAT." Its source code leaked online, letting anyone customize it. The result: thousands of variants, all beaconing through port 1177.

njRAT turns infected computers into surveillance devices. It can:

• Operate your webcam without the light turning on
• Log every keystroke you type
• Steal credentials stored in browsers
• Upload and download files
• Update itself to evade detection

The malware creates TCP connections to port 1177 every few seconds—a heartbeat that says "I'm still here, what do you want me to do?"³ It uses Base64-encoded requests and fast-flux DNS to hide its command and control servers.

Why This Port?

There's no technical reason njRAT chose port 1177. The malware could use any port. But in the underground economy of malware, conventions emerge. Someone chose 1177 early on. Others copied it. The port became associated with this specific threat.

Security teams now know: traffic on port 1177 is worth investigating. Firewalls block it. Intrusion detection systems flag it. The port's reputation is inseparable from the malware that claimed it.

This is how registered ports work in practice. IANA can assign a port to DKMessenger, but IANA can't enforce that assignment. If a protocol disappears and malware moves in, the malware wins by default.

The Registered Port Paradox

Port 1177 demonstrates something fundamental about the registered port range: registration doesn't mean enforcement. IANA maintains a list of who's supposed to use what. But unlike the well-known ports (0-1023), registered ports aren't protected by operating system privileges. Anyone can listen on port 1177.

DKMessenger registered the port properly, presumably with good intentions. But registration without adoption is just paperwork. The protocol died. The port number remained. And something else moved in.

Security Implications

If you see unexpected traffic on port 1177 on your network, investigate immediately:

Check what's listening:

# Linux/Mac
sudo lsof -i :1177
sudo netstat -tulpn | grep 1177

# Windows
netstat -ano | findstr :1177

Look for:

• Connections to unfamiliar IP addresses
• Processes you don't recognize
• Base64-encoded traffic patterns
• Periodic beaconing behavior (connections every few seconds)

njRAT primarily affects Windows systems (it's written in .NET MSIL), but its command and control traffic can originate from anywhere². The malware was particularly prevalent in Middle Eastern regions, with an estimated 24,000 infected computers globally at its peak¹.

What This Port Teaches Us

Port 1177 is a reminder that the Internet's infrastructure is built on conventions, not laws. IANA can assign. Protocols can register. But actual usage is determined by whoever writes software that people (or malware) actually run.

The gap between official assignment and real-world use reveals something important: ports are just numbers. They have the meaning we give them through the software we build. DKMessenger gave port 1177 one meaning in 2004. njRAT gave it another meaning in 2012.

The latter meaning stuck.