Malware Similarity & Clustering Engine

PILLAR 2: CODE DISTANCE & CLUSTERS

Multi-metric fuzzy hashing (SSDEEP), Imphash cosine vectorization, Control Flow Graph (TLSH) similarity, and 2D cluster manifold projection.

Indexed Families

6 Distinct Clusters

Cluster Silhouette

0.884 (High Cohesion)

Filter Cluster:

X: Static Variance • Y: Dynamic Variance

WannaCry.exe

LockBit_3.0_Ransom.bin

BlackCat_ALPHV.exe

WannaCry_Variant_B.exe

PlayRansomware.exe

SikoMode.exe

SikoNim_Drop2.exe

NimStealer_v2.exe

NimPasswordGrabber.bin

RedLineStealer.exe

RedLine_v24_Pack.exe

RacoonStealer_v2.exe

MetaStealer.exe

CobaltStrike_Beacon.bin

CS_Malleable_Profile4.bin

BruteRatel_Badger.dll

SillyPutty.exe

Emotet_Epoch5_Doc.exe

QakBot_OneNote_Payload.dll

Unknown_Anomalous_0day.bin

Kernel_Hook_Payload.sys

ID: SAMPLE-001 • Family: Ransomware

LockBit Cluster

Cluster Centroid Distance:0.040 (Dense Core)

Silhouette Cohesion Score:s(i) = +0.89

Primary Threat Score:98 / 100

Cryptographic & Binary Fingerprints

SSDEEP Block Hash:

98304:r1hZ4rF19z9:r1hZ4

Imphash Vector:

f34d5f2d4577ed6d9ceec516c1f5a744

Entropy:

7.98 / 8.0

Packer / Stub:

Custom ZIP .rsrc

Cluster Affiliation: High-speed encryption strain sharing WannaCry/LockBit shadow deletion and service persistence routines.