Synful Knock Scanner
MD5 (synknockscan-1.0.1.tgz) = 0bbb2d46264020a4cc4e4083adf55a6c

SHA1 (synknockscan-1.0.1.tgz) = fba0289b03def791b7e22c5041b8bd1fc3420b9c

SHA256 (synknockscan-1.0.1.tgz) = c07d722900f787a7c1fb63faf4362142844c32e8d79e3f5ea5681d0dd66deef1

Synful Knock Scanner

Talos has developed a Python script for customers to scan their own network to identify routers that may have been compromised by this specific malware. The script works by scanning networks, looking for devices answering to the SYNful Knock malware. This tool can only detect hosts responding to the malware "knock" as it is known at a particular point in time. It can be used to help detect and triage known compromises of infrastructure. Upon successful detection of the “knock” on your network, the Synful Knock Scanner will provide further instructions so that we may assist you.