Malicious SHA-256 Hashes
Free feed of SHA-256 file hashes for known malware shared by Twitter/X researchers
Malicious SHA-256 Hashes
SHA-256 file hashes for known malware
Related Threat Intelligence feeds: URLs · Domains · IPs · MD5 · All IOC types
SHA-256 hashes by window
-
SHA-256 hashes
-
SHA-256 hashes
-
SHA-256 hashes
-
SHA-256 hashes
Currently tracking 584 SHA-256 hashes reported in the last 30 days. Data generated 2026-11-11 07:45 UTC.
What this list contains
- Source: ~95 Twitter/X researchers, every 15 min.
- Malware sample hashes: RATs, stealers, ransomware, loaders.
- No known collisions. Best for forensic evidence.
- Verdicts: check VirusTotal or MalwareBazaar.
Recent samples
Latest SHA-256 hashes from the past 7 days. Live from api.tweetfeed.live/v1/week/sha256.
Top tags for SHA-256 hashes
Formats and how to use
The malicious SHA-256 hashes are available in four formats:
| Format | Where | Best for |
|---|---|---|
| JSON API | api.tweetfeed.live/ | SOAR / SIEM enrichment, scripts |
| CSV | today / week / month / year .csv | bulk import, spreadsheets, blocklists |
| RSS | rss.xml | watch new IOCs in a reader |
| MCP | mcp.tweetfeed.live | live lookups from AI agents / Claude |
- Feed into your EDR as known-bad hashes.
- Pivot each hash in VirusTotal or Malpedia.
Frequently asked questions
What is a SHA-256 hash?
A 64-character fingerprint of a file. Identical files give identical hashes.
SHA-256 vs MD5: which should I use?
SHA-256 for evidence and high confidence, MD5 for fast scans in legacy tools. We publish both.
Are these hashes verified malicious?
No, it is OSINT. Check VirusTotal or MalwareBazaar for a verdict before you act.
Is the malicious SHA-256 hashes list free?
Yes. CC0 1.0, no key or sign-up, commercial use allowed.
License
IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.