I did a little bit of research, and I couldn't find any known trojan or otherwise, which operates on a default port of 1027. However ICQ does in fact run on port 1027, which is suspicious because some trojans have a feature that allows it's users to be notified via ICQ if the trojan has been executed by the victim.

Some sites I came across:

http://www.iana.org/assignments/port-numbers

http://www.simovits.com/sve/nyhetsar...heter9902.html

Hope this helps.