Lesson 3.9: Hashes, reputation and variants
The fastest check for a suspicious file is its hash against a threat-intelligence feed. But a hash identifies one exact file: change a single byte and it's a different hash. The Pyramid of Pain explains why: hashes are trivial for attackers to change, while their infrastructure and behaviour are much harder. In the lab the hunt for Can's keylogger returns four files from four machines with different names; only one matches the feed. You find out why, and catch the variants by what they share instead of by hash.
16 min
You will learn to
- Use hashes to identify files
- Explain why one changed byte changes the hash
- Explain the Pyramid of Pain
- Compare variants with strings and diff
- Pivot from a hash to stronger indicators
Key terms
- File hash
- A fixed-length fingerprint of a file's exact bytes: MD5 (32 hex), SHA-1 (40), SHA-256 (64).
- Reputation lookup
- Checking a hash, domain or IP against threat-intelligence sources.
- Variant
- A slightly changed build of the same malware.
- Pyramid of Pain
- A model by David Bianco (2013) ranking indicators by how much it hurts the attacker when defenders block them: hashes, IPs, domains, host and network artefacts, tools, TTPs.
- TTP
- Tactics, techniques and procedures: how an attacker operates, as catalogued in MITRE ATT&CK.
← The Linux filesystem hierarchy · All lessons · IPv6: the next generation of addresses →