IMPLEMENTING TLSH BASED DETECTION TO IDENTIFY MALWARE VARIANTS

Summary from the TLDR InfoSec newsletter

TLSH is a locality-sensitive, fuzzy hashing mechanism that can be used to compare two files to determine how similar they are. In this post, Target's security team walks through how they utilize TLSH for hunting malware variants of known malware families using Strelka. This approach requires files to be over 50 bytes in length, regularly updating a list of known malicious TLSH values, carefully tuning similarity thresholds, and may not work on packed or obfuscated malware.