Malware-family classification is an evidence-based grouping, not a conclusion from one matching indicator. Exact hashes identify identical file contents; related but modified samples need other evidence. Even a well-supported family assessment does not, by itself, identify who operated the sample or prove that two incidents share an operator.

Begin with exact identity and provenance

Calculate a cryptographic hash such as SHA-256 and record where, when, and how the sample was collected. An exact hash match can establish that two files have the same bytes, but a one-byte change produces a different digest. Preserve the original artifact and follow approved handling procedures; do not execute a suspicious file on a production endpoint.

Compare samples using more than one method

• Code similarity: compare functions, resources, configuration, and structural features. Fuzzy hashes such as ssdeep or TLSH can suggest similarity, but a match is not proof of a common family.
• Behavior: in an authorized isolated analysis environment, compare persistence, process activity, file changes, and network behavior. Sandbox results depend on the environment and may not show every capability.
• Metadata: examine compilation details, imports, signatures, and embedded resources as supporting clues. These can be absent, manipulated, or copied.
• Infrastructure: compare observed domains, addresses, certificates, and timing where available. Shared hosting or an IP reputation result alone is weak evidence of a family relationship.

Separate family classification from authorship

Similar code may result from a shared builder, public tooling, copied components, or reuse by a different operator. A family label is useful for describing technical similarities and expected behavior; it should not be presented as proof of developer identity, campaign ownership, or attribution.

Build a reproducible comparison

1. List the samples and their collection source, time, and SHA-256 values.
2. Record which comparison methods and tool versions were used.
3. Document similarities, differences, and alternative explanations.
4. Keep provider labels separate from direct analysis observations.
5. State confidence and what additional evidence could change it.

Use classification to improve defense cautiously

A well-supported relationship may help analysts search for related files or behaviors in retained telemetry and prioritize detection engineering. Test proposed detections against benign software and alternate samples before deployment. Do not automatically block every file or address associated with a broad family label without validating the specific evidence and business impact.

The strongest classification explains how the samples are similar, which evidence is uncertain, and where the comparison stops. That is more useful than a confident-sounding family name without a reproducible basis.