Comparing Malicious Files 2.0 - Malware Utkonos
2026-09-18 16:00 - 17:00 (CET) | Tesla
This talk is about using LLMs to build and modernize software where correctness matters. It follows the work at two scales: modernizing a similarity-digest algorithm that must match its reference implementation bit-for-bit, and building malbench, a local-first triage and clustering workbench for malware analysts.
malbench is a local-first triage and clustering workbench for malware analysts. It pulls samples and threat intelligence from various sources, computes similarity digests, runs YARA rules, and then turns a flat pile of hashes into structure: it clusters and graphs files by features they actually share and weaves several of those lenses into a single view.
I needed a wider variety of hashing algorithms, so in addition to ssdeep and TLSH, I took a dormant 2021 Go port of sdhash, a similarity-digest algorithm used in malware triage and code-reuse detection, and modernized it into a clean, dependency-free, fully-tested library. A deterministic verification corpus and parallel C++/Go harnesses turn the original reference implementation into an oracle: millions of pair comparisons, zero unexplained divergences. Around that sit total test coverage as a drift alarm, strict session and context hygiene, profile-before-you-optimize with one change measured at a time. The result is a repeatable process for adopting and modernizing old code and for building new tools on top of it.
