Lion Cipher Lab
Cluster and attribute malware with fuzzy hashing (ssdeep, TLSH, and imphash)
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A SHA-256 hash answers exactly one question: is this the identical file, yes or no? Change a single byte — recompile with a new build tag, flip a flag, repack — and the hash is completely different, so a threat actor gets a 'new' file for free and your blocklist of hashes is instantly stale. That is why hunting on cryptographic hashes alone is a treadmill. Fuzzy and similarity hashes break the treadmill: ssdeep and TLSH produce hashes whose SIMILARITY reflects how alike two files are, and imphash fingerprints a Windows program's import table so builds from the same source or toolchain cluster…
What you'll learn
- explaining why a cryptographic hash (SHA-256) cannot tell you two files are related
- computing and reading ssdeep (context-triggered piecewise hashing) similarity scores
- computing and reading TLSH (locality-sensitive hashing) distance scores
- computing imphash (PE import-table fingerprint) with pefile to cluster same-toolchain builds
- building a pairwise similarity matrix in Python — the actual mechanic of clustering a malware family
- knowing the limits: packers destroy ssdeep similarity; imphash is trivially evaded
- pivoting on ssdeep/imphash in VirusTotal and MISP
- treating a hash match as ONE signal, never attribution on its own
- practicing malware-triage tradecraft safely, using only self-made benign files
Steps in this lab
- The problem SHA-256 cannot solve
- Safety first: there is no malware in this lab
- Install the three hashers: ssdeep, py-tlsh, pefile
- Build a benign sample set — and watch SHA-256 fail
- The reveal: ssdeep and TLSH cluster what SHA-256 could not
- imphash: fingerprint the toolchain, not the bytes
- This matrix IS how you cluster a family — and where it is used
- The limits, and how a pro does it better