# New CelesTLSH Feature: Manual TLSH Lookups!

**URL:** <https://community.limacharlie.com/t/new-celestlsh-feature-manual-tlsh-lookups/240>\
**Category:** Magonia Research\
**Created:** [March 30, 2025, 4:57am UTC](https://community.limacharlie.com/t/new-celestlsh-feature-manual-tlsh-lookups/240 "2025-03-30T04:57:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Signalblur](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/signalblur/32/11_2.png) [@Signalblur](https://community.limacharlie.com/u/Signalblur)\
**Post date:** [March 30, 2025, 4:57am UTC](https://community.limacharlie.com/t/new-celestlsh-feature-manual-tlsh-lookups/240/1 "2025-03-30T04:57:53Z")

</div>

Need to check if a TLSH hash from outside LimaCharlie matches known malware? Our new lookup feature lets you perform distance checks on any TLSH hash, without requiring the original file. Simply provide the hash and optional distance threshold to quickly identify potential matches in our malware database. 🥂 😎

Unlike the automatic detection, this function returns all matches within the specified distance score, giving you a complete view of potential matches rather than just the single closest match.

Example Results:

```auto
{
  "matches": [
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-26T22:17:26Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/56bbcf638750d191915205b678871a26af37ee22205b26660c8b700380e94f00/",
      "matched_tlsh": "T19AB34BC2FA43E4F5E96600B11137A73B4B33F1395029DA43DB69A936EC91950EB1B39C",
      "score": 28,
      "sha256": "56bbcf638750d191915205b678871a26af37ee22205b26660c8b700380e94f00"
    },
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-26T18:52:20Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/d644d977e6ca03c0a1d589bb03d088f045ee57dfbdfeb99dee57a64879633d98/",
      "matched_tlsh": "T150B34AC1E643E4F5E96A01712137A7374B3AF53A0029DA47CB79A932ECA1961E71F31C",
      "score": 31,
      "sha256": "d644d977e6ca03c0a1d589bb03d088f045ee57dfbdfeb99dee57a64879633d98"
    },
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-14T00:17:23Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/a4c378ad6f25dda642c2e28b216e0e9889ef4e378331fb34cb00d6d33d093604/",
      "matched_tlsh": "T18AB34BC5B687E4F5E86600712137A7378B37F439002DDA47DB6CA932ECA2591E71A36C",
      "score": 32,
      "sha256": "a4c378ad6f25dda642c2e28b216e0e9889ef4e378331fb34cb00d6d33d093604"
    },
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-20T16:47:45Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/d776efa305ebb06a13e0089fe1768c4ff3409222ce11baf4fa0dff7484e39649/",
      "matched_tlsh": "T1D8B35BC1F743E5F5E96600B11037A7378B33F535102ADA87DB69B932AC62950EB1A36C",
      "score": 37,
      "sha256": "d776efa305ebb06a13e0089fe1768c4ff3409222ce11baf4fa0dff7484e39649"
    },
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-27T19:52:53Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/398dee1e2b95913ce168d5f5e8b5e297fd076ea23cdf741fb128b23fe533cf77/",
      "matched_tlsh": "T15EB36AC6B743E8F5F96601712037A3378B3BF43A502DCA47CB69A932AC51551EB1A32C",
      "score": 40,
      "sha256": "398dee1e2b95913ce168d5f5e8b5e297fd076ea23cdf741fb128b23fe533cf77"
    },
    {
      "family_name": "Mirai",
      "first_seen": "2025-03-23T09:41:31Z",
      "imphash": "N/A",
      "intel": "https://bazaar.abuse.ch/sample/4fcf85baa4843a91b668ab467c6b96d3435ba058270a88248df6b0ed00ef1d55/",
      "matched_tlsh": "T1C4B36BC1B683E4F5E96600B2203BE7339B33E5394029DE43DB69AD32EC52551EB1A75C",
      "score": 48,
      "sha256": "4fcf85baa4843a91b668ab467c6b96d3435ba058270a88248df6b0ed00ef1d55"
    }
  ],
  "message": "Found 6 matches for TLSH hash T105B34AC2F643E4F5F86600B12032A73AC73BF93A5029DA47CB6DA936EC51591E61B35C",
  "threshold": 50,
  "tlsh_hash": "T105B34AC2F643E4F5F86600B12032A73AC73BF93A5029DA47CB6DA936EC51591E61B35C"
}

```

 ![Screenshot 2025-03-30 at 12.55.30 AM](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/c095e6a913f9b5145239f46439feed49cc92858e.png)  
 ![Screenshot 2025-03-30 at 12.55.36 AM](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/d0a8d43b38c0e6e1a481af369f1e0f60d2ed18b1.png)