trendmicro / tlsh

Other
726 stars 135 forks source link

predictions by command tlsh_pattern is not outputting TLSH value of input sample, how to understand this? #122

Closed SrikanthPusarla closed 2 years ago

SrikanthPusarla commented 2 years ago

I tried the instructions provided at https://github.com/trendmicro/tlsh/tree/master/tlshCluster/malbaz and the prediction command "tlsh_pattern -l mb_2021-09-18.tlsh -pat clust_389300.pat -showmiss 100 | less", but its output as below, it is not giving input TLSH and the cluster it got assigned, how do we understand this? how do we predict cluster of a new unseen file with TLSH as input?

NEAR-MISS n/a CoinMiner 83 NEAR-MISS Gafgyt MiraiGafgyt 35 Mirai MiraiGafgyt 26 NEAR-MISS Gafgyt MiraiGafgyt 38 NEAR-MISS Gafgyt MiraiGafgyt 38 NEAR-MISS Mirai MiraiGafgyt 42 NEAR-MISS Mirai MiraiGafgyt 51 NEAR-MISS Mirai MiraiGafgyt 39 .............

SrikanthPusarla commented 2 years ago

Got it by modifying print statement in tlsh_pattern.cpp file