ReversingLabs Hashing Algorithm

This report outlines ReversingLabs’ functional similarity hashing (RHA), which clusters executables by behavior-derived features across four precision levels to improve malware detection over MD5/SHA-1 and similarity hashes like imphash, ssdeep, and tlsh. Using 7.75M samples associated with Zeus, RHA reduced uniqueness to 475K hashes (≈93% reduction), revealed a prevalent custom packer (“cpFlush”) that skewed AV classifications, and showed that unpacked layers preserved functional hash groupings. The findings highlight RHA’s efficacy for scalable malware correlation, low collision with allowlisted files, and its integration into automated threat classification.