Synful Knock Scanner
md5sum: 2c53f7c56f727ffb6dd8d16ddb3a9b02

shasum: 7e52a89f395ee6a81948c711039eee8f2cb9b60d

sha256sum: 25651d9235e99ba94dec693972c51ee96b2bef3e2f9e3fa6fa304a44bd48bd7e

Synful Knock Scanner

Talos has developed a Python script for customers to scan their own network to identify routers that may have been compromised by this specific malware. The script works by scanning networks, looking for devices answering to the SYNful Knock malware. This tool can only detect hosts responding to the malware "knock" as it is known at a particular point in time. It can be used to help detect and triage known compromises of infrastructure. Upon successful detection of the “knock” on your network, the Synful Knock Scanner will provide further instructions so that we may assist you.