From Symantec, A UDP packet bound for internal port 31337 should be considered suspicious. Numerous trojans and backdoors use this default port as a means to setup external communication with the attacking server. Should be two answers, Backdoor and Trojan. Some popular trojans that use this port for default communication include; Back Fire, Back Orifice, Baron Night, Beeone, BO client, BO Facil, BO spy, BO2, cron / crontab, Freak88, icmp_pipe.c, Sockdmini, Deep BO.

Ray is most likely infected with a backdoor such as Back Orifice. https://en.wikipedia.org/wiki/Back_Orifice

Spyware is software that spies on you, tracking your internet activities in order to send advertising (Adware) back to your system.

Keyloggers: Records everything you type on your PC in order to glean your log-in names, passwords, and other sensitive information, and send it on to the source of the keylogging program. Many times keyloggers are used by corporations and parents to acquire computer usage information.

Rootkit: This one is likened to the burglar hiding in the attic, waiting to take from you while you are not home. It is the hardest of all Malware to detect and therefore to remove; many experts recommend completely wiping your hard drive and reinstalling everything from scratch. It is designed to permit the other information gathering Malware in to get the identity information from your computer without you realizing anything is going on.

Backdoors are much the same as Trojans or worms, except that they open a “backdoor” onto a computer, providing a network connection for hackers or other Malware to enter or for viruses or SPAM to be sent.

Trojans are written with the purpose of discovering your financial information, taking over your computer’s system resources, and in larger systems creating a “denial-of-service attack ” Denial-of-service attack: an attempt to make a machine or network resource unavailable to those attempting to reach it. Example: AOL, Yahoo or your business network becoming unavailable.

EDIT: Please consider rephrasing the question or the given answers as this port can be used by any of those mentioned (maybe except keylogger)... Or at lease give reason why you think Backdoor is most appropriate answer.