Using hashes to find Linux malware is a waste of time. Unfortunately, it's still common to recommend doing it. In this video I'll show you how to trivially change a Linux binary to evade detection using cryptographic hashes with this elite command: echo -ne '\x0'

Use the fuzz! You can use the hashes on reports to show what you looked at. Fuzzy matching, string comparisons, good yara rules, all better options 👩🏽‍💻

Sadly, fuzzy hashes are slow/resource intensive doing it across many files.

So outside of the coventional hashing and procedural hashing checks, what would be a better menthod? I get sandboxing malware can be effective but won't that give it a chance to escape the enviroment?

@WhitfieldsDad Basically they will only work for low-hanging fruit. I think heuristics of malware activity work best.