Malicious MD5 Hashes

Free feed of MD5 file hashes for known malware shared by Twitter/X researchers


Malicious MD5 Hashes

MD5 file hashes for known malware

Related Threat Intelligence feeds: URLs · Domains · IPs · SHA-256 · All IOC types

MD5 hashes by window

Today

-

MD5 hashes

Week

-

MD5 hashes

Month

-

MD5 hashes

Year

-

MD5 hashes

Currently tracking 119 MD5 hashes reported in the last 30 days. Data generated 2026-11-11 07:45 UTC.

What this list contains

  • Source: ~95 Twitter/X researchers, every 15 min.
  • Malware sample hashes: RATs, stealers, ransomware, loaders.
  • MD5 has known collisions. Prefer SHA-256 for high confidence.
  • Verdicts: check VirusTotal or a sandbox.

Recent samples

Latest MD5 hashes from the past 7 days. Live from api.tweetfeed.live/v1/week/md5.

Loading samples

Top tags for MD5 hashes

Filter the MD5 feed by malware family or category. Each tag has its own landing page with recent samples and context.

See all tags on the Dashboard or browse the full IOC feed.

Formats and how to use

The malicious MD5 hashes are available in four formats:

FormatWhereBest for
JSON APIapi.tweetfeed.live/v1/<window>/md5SOAR / SIEM enrichment, scripts
CSVtoday / week / month / year .csvbulk import, spreadsheets, blocklists
RSSrss.xmlwatch new IOCs in a reader
MCPmcp.tweetfeed.livelive lookups from AI agents / Claude
  • Feed into your EDR or YARA as known-bad hashes.
  • Pivot each hash in VirusTotal or Malpedia.

Frequently asked questions

What is an MD5 hash?

A 32-character fingerprint of a file. Fast, but it has known collisions.

Why MD5 if SHA-256 is more secure?

Many legacy AV and IDS tools index by MD5. Prefer SHA-256 when you can.

Are these hashes verified malicious?

No, it is OSINT. Check VirusTotal or MalwareBazaar for a verdict before you act.

Is the malicious MD5 hashes list free?

Yes. CC0 1.0, no key or sign-up, commercial use allowed.

License

IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.