Search

Hash (MD5/SHA) OSINT Tools

A file hash (MD5, SHA-1, SHA-256) is a fingerprint you can check against threat-intelligence databases and sandboxes to learn whether a file is known malware, who has seen it, and what it does. These tools are core to CTI and DFIR triage. Below are the 72 OSINT tools that take a hash as input.

72tools
Browse with filters
DeHashed icon

DeHashed

Breach intelligence and credential search

PaidWebAPI
IN+2
OUT
Etherscan icon

Etherscan

Ethereum blockchain explorer

FreemiumWebAPI
IN
OUT
VirusTotal icon

VirusTotal

Analyze files, URLs, domains, and IPs

FreemiumWebAPI
IN+2
OUT+1
ANY.RUN icon

ANY.RUN

an interactive malware sandbox for analyzing suspicious files, URLs, and netw

FreemiumWeb
IN
OUT
ANY.RUN Threat Intelligence Lookup icon

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

FreemiumWebAPI
IN
OUT
AlienVault OTX icon

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

FreeWeb
IN+2
OUT
Anomali ThreatStream icon

Anomali ThreatStream

Anomali TIP and feed management platform

PaidWebAPI
IN
OUT
Autopsy icon

Autopsy

a digital forensics platform for investigating disk images, filesystems, and

FreeOSSCLI
IN
OUT
BlockCypher icon

BlockCypher

a blockchain API and explorer for Bitcoin, Ethereum, Litecoin, and related tr

FreemiumWebAPI
IN
OUT
Blockchain.com Explorer icon

Blockchain.com Explorer

Blockchain transaction and wallet explorer

FreeWebAPI
IN
OUT
Blockchair icon

Blockchair

a multi-chain blockchain explorer for addresses, transactions, blocks, tokens

FreemiumWebAPI
IN
OUT
Chainalysis icon

Chainalysis

Commercial blockchain intelligence platform

PaidWebAPI
IN
OUT
CheckLeaked icon

CheckLeaked

Aggregated breach search across Dehashed, Snusbase and LeakCheck

FreemiumWebAPI
IN+2
OUT+1
Cisco Talos Intelligence icon

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

FreeWeb
IN+2
OUT
Cortex icon

Cortex

an observable analysis and active response engine used with TheHive and secur

FreemiumOSSCLI
IN+2
OUT
CyberChef icon

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

FreeOSSCLI
IN+2
OUT
Cyberbro icon

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

FreeOSSWebAPI
IN+2
OUT+1
DFIR Platform icon

DFIR Platform

API toolkit for phishing triage, IOC enrichment and BEC investigation

FreemiumAPIWeb
IN
OUT
EchoTrail icon

EchoTrail

Windows process prevalence and behaviour lookup

FreemiumWebAPI
IN
OUT
FLOSS icon

FLOSS

a FLARE tool for extracting obfuscated strings from malware and suspicious bi

FreeOSSCLI
IN
OUT
Feodo Tracker icon

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

FreeWeb
IN+2
OUT
Google Safe Browsing icon

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists

FreemiumWeb
IN+2
OUT
Group-IB Threat Intelligence icon

Group-IB Threat Intelligence

Russian-region-focused TI platform

PaidWebAPI
IN
OUT
Hybrid Analysis icon

Hybrid Analysis

a malware analysis platform that runs files and URLs in sandbox environments

FreemiumWeb
IN
OUT
IBM X-Force Exchange icon

IBM X-Force Exchange

a threat intelligence sharing and enrichment platform for indicators, malware

FreemiumWeb
IN+2
OUT
Imunify360 Sandbox icon

Imunify360 Sandbox

Palo Alto WildFire malware analysis portal

PaidWebAPI
IN
OUT
Intezer Analyze icon

Intezer Analyze

a malware analysis platform that classifies files, code reuse, and threat rel

FreemiumWeb
IN
OUT
Joe Sandbox icon

Joe Sandbox

a malware analysis sandbox for dynamic and static investigation of files, URL

FreemiumWeb
IN
OUT
Kaspersky Threat Intelligence Portal icon

Kaspersky Threat Intelligence Portal

Kaspersky free IOC reputation portal

FreemiumWebAPI
IN
OUT
Koodous icon

Koodous

Android malware intelligence platform

FreemiumWebAPI
IN
OUT
MISP icon

MISP

an open-source threat intelligence platform for sharing indicators, events, g

FreeOSSCLI
IN+2
OUT
MalShare icon

MalShare

Community malware sample repository

FreeWebAPI
IN
OUT
Malpedia icon

Malpedia

Malware-family encyclopedia with YARA rules and actor links

FreeWebAPI
IN
OUT
MalwareBazaar icon

MalwareBazaar

an abuse.ch malware sample exchange for searching hashes, tags, families, and

FreeWeb
IN
OUT
Malwarebytes Labs icon

Malwarebytes Labs

a threat research publication and malware intelligence source for campaigns a

FreeWeb
IN+2
OUT
Mandiant Advantage icon

Mandiant Advantage

Mandiant TI and APT analytics platform

PaidWebAPI
IN+1
OUT
MetaDefender Cloud icon

MetaDefender Cloud

Multi-engine scan of files, hashes, IPs and URLs

FreemiumWebAPI
IN+1
OUT
Microsoft Defender Threat Intelligence icon

Microsoft Defender Threat Intelligence

Microsoft passive DNS and TI graph

FreemiumWebAPI
IN
OUT
Mobile Verification Toolkit icon

Mobile Verification Toolkit

a mobile forensics toolkit for checking Android and iOS devices for compromis

FreeOSSCLI
IN
OUT
OpenCTI icon

OpenCTI

an open-source cyber threat intelligence platform for modeling entities, rela

FreeOSSCLI
IN+2
OUT
OpenGraph Intel icon

OpenGraph Intel

Visual OSINT framework that enriches entities via transforms into graphs

FreeOSSWebCLI
IN+3
OUT+1
OpenPhish icon

OpenPhish

a phishing intelligence service that detects and publishes active phishing in

FreemiumWeb
IN+2
OUT
PhishTank icon

PhishTank

a community phishing verification service for checking and submitting suspect

FreeWeb
IN+2
OUT
PhotoDNA icon

PhotoDNA

Known-image matching for safety workflows

FreeAPI
IN
OUT
Polygonscan icon

Polygonscan

a Polygon blockchain explorer for addresses, transactions, tokens, contracts,

FreemiumWebAPI
IN
OUT
Polyswarm icon

Polyswarm

Decentralized multi-engine TI marketplace

FreemiumOSSWebAPI
IN
OUT
Pulsedive icon

Pulsedive

a threat intelligence platform for enriching indicators, domains, IPs, and UR

FreemiumWeb
IN+2
OUT
Pulsedive Explore icon

Pulsedive Explore

Pulsedive free pivoting interface

FreemiumWebAPI
IN
OUT
QiAnXin TI icon

QiAnXin TI

QiAnXin Chinese TI portal

FreemiumWebAPI
IN
OUT
Recorded Future icon

Recorded Future

Recorded Future TI graph and risk platform

PaidWebAPI
IN+1
OUT
Snusbase icon

Snusbase

Breach and credential intelligence search

PaidWebAPI
IN+1
OUT
Solscan icon

Solscan

a Solana blockchain explorer for addresses, tokens, transactions, programs, a

FreeWebAPI
IN
OUT
TheHive icon

TheHive

a scalable security incident response platform for case management and analys

FreemiumOSSCLI
IN+2
OUT
TheHive Cortex Analyzers icon

TheHive Cortex Analyzers

Cortex enrichment analyzer plugin library

FreeOSSCLI
IN
OUT
ThreatBook icon

ThreatBook

Chinese commercial TI platform

FreemiumWebAPI
IN
OUT
ThreatConnect icon

ThreatConnect

ThreatConnect TIP and SOAR platform

PaidWebAPI
IN
OUT
ThreatFox icon

ThreatFox

an abuse.ch platform for sharing malware indicators and command-and-control i

FreeWeb
IN+2
OUT
ThreatMiner icon

ThreatMiner

Free TI aggregator for IOC enrichment

FreeWebAPI
IN
OUT
ThreatQ icon

ThreatQ

ThreatQuotient TIP and investigation platform

PaidWebAPI
IN
OUT
ThreatView.io icon

ThreatView.io

Free curated TI feeds in CSV form

FreeWeb
IN
OUT
Showing 60 of 72 — browse all

Find specific data from hash (md5/sha)

IOC (Indicator of Compromise)58Report / Summary37Threat Actor Profile29Malware Sample21Relationship Map9Financial Records7Timeline / Chronology6SSL Certificate5

Investigate by other data types

Email AddressPhone NumberUsernameReal NameIP AddressDomain NameCryptocurrency WalletImage / PhotoURLCompany NameMalware Sample