Malicious SHA-256 Hashes

SHA-256 is a cryptographic hash function that produces a 64-character hexadecimal fingerprint of a file. Two identical files always produce the same hash, but two different files producing the same SHA-256 hash has never been demonstrated, so it is the recommended hash for high-confidence sample identification.

Every 15 minutes. The pipeline scrapes RSS feeds from public Twitter/X researcher accounts and lists, extracts 64-character hex SHA-256 hashes from tweets, deduplicates against the past year, tags them with malware family, and republishes the result in CSV, JSON and RSS.

Use SHA-256 when collision resistance matters: forensic evidence chain of custody, cryptographic signature verification, blockchain-style integrity. Use MD5 when speed and storage matter and collision risk is acceptable: large-scale endpoint scanning, AV signature databases. TweetFeed publishes both; many tweets include both for the same sample.

TweetFeed is OSINT, not a sandbox. Hashes are sourced from public posts by infosec researchers, then deduplicated and tagged. Most posts include sandbox links; cross-reference VirusTotal, MalwareBazaar or your own sandbox to confirm a sample's verdict and gather family attribution before action.