tlsh_unittest

compare similar files using fuzzy hashing

Install

All systems
curl cmd.cat/tlsh_unittest.sh
Debian Debian
apt-get install tlsh-tools
Ubuntu
apt-get install tlsh-tools
Arch Arch Linux
pacman -S tlsh
image/svg+xml Kali Linux
apt-get install tlsh-tools
Fedora
dnf install tlsh
Windows (WSL2)
sudo apt-get update sudo apt-get install tlsh-tools
Raspbian
apt-get install tlsh-tools
Dockerfile
dockerfile.run/tlsh_unittest

tlsh-tools

compare similar files using fuzzy hashing

The Trend Micro Locality Sensitive Hash is a fuzzy hash algorithm that can be used to compare similar but not identical files. Identifying near duplicates and similar files is known to be useful to identify malware samples with similar binary file structure, variants of spam email, or backups with corrupted files. This package contains the tlsh_unittest utility, a command-line tool to generate TLSH hash values and compare TLSH hash values to determine similar files.

tlsh

TLSH is a fuzzy matching library. Given a byte stream with a

minimum length of 256 bytes (and a minimum amount of randomness), TLSH generates a hash value which can be used for similarity comparisons. Similar objects will have similar hash values which allows for the detection of similar objects by comparing their hash values.