Malicious SHA-256 Hashes

SHA-256 is a cryptographic hash function that produces a 64-character hexadecimal fingerprint of a file. Two identical files always produce the same hash, but two different files producing the same SHA-256 hash has never been demonstrated, so it is the recommended hash for high-confidence sample identification.

Every 15 minutes. The pipeline scrapes RSS feeds from public Twitter/X researcher accounts and lists, extracts 64-character hex SHA-256 hashes from tweets, deduplicates against the past year, tags them with malware family, and republishes the result in CSV, JSON and RSS.

Use SHA-256 when collision resistance matters: forensic evidence chain of custody, cryptographic signature verification, blockchain-style integrity. Use MD5 when speed and storage matter and collision risk is acceptable: large-scale endpoint scanning, AV signature databases. TweetFeed publishes both; many tweets include both for the same sample.

TweetFeed is OSINT, not a sandbox. Hashes are sourced from public posts by infosec researchers, then deduplicated and tagged. Most posts include sandbox links; cross-reference VirusTotal, MalwareBazaar or your own sandbox to confirm a sample's verdict and gather family attribution before action.

All TweetFeed IOC data, including this SHA-256 hash subset, is released under CC0 1.0 Universal (Public Domain Dedication). No attribution required, no warranty. Commercial use is allowed. The TweetFeed website code and branding are not covered by CC0.