[ConorSheehan1]

Very interesting! A tutorial to check if kimwolf is running on your network would be nice

[pamcake]

Not exactly the answer but if you have one of the affected mentioned devices it should be listening on TCP port 5555. You can do a port scan for that.

   nmap -Pn 192.168.0.0/16 -p 5555

Replace netmask as appropriate.

Now that it's publicly known I guess it's possible that they will close the door post-infection to avoid detecton. And it won't detect any other devices it's spread further to.

If you have a cheapo Android-based TV box or stick like the ones mentioned, throw it out or reflash it with Armbian after forensics.

I'm sure there are HN readers out there who have one of these. They were very popular a couple of years back.

[nubinetwork]

Based on the article, try looking for android devices with adb running on the network.

[thenthenthen]

This article[0] includes a link to a online checker: https://synthient.com/check

Have not tested it myself ymmv.

[0] https://synthient.com/blog/a-broken-system-fueling-botnets

[HappyPanacea]

Does someone know if the port must be 5555 for this botnet?

[BloodyIron]

Well the first thing to check is, do you own and operate any of these janky Android "TV" boxes sold by companies nobody has heard of? If yes? Then there's probably your answer.