Search

Find Threat-actor profiles from a file hash

Hash (MD5/SHA)Threat Actor Profile

Have a file hash? These OSINT tools take a file hash as input and return threat-actor profiles. 31 tools in our catalogue make this exact pivot — compare them by pricing, platform, and what they output, then chain the results into the next step of your investigation.

31tools
All Hash (MD5/SHA) tools
AbuseIPDB icon

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

FreemiumWeb
IN+2
OUT
AlienVault OTX icon

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

FreeWeb
IN+2
OUT
Anomali ThreatStream icon

Anomali ThreatStream

Anomali TIP and feed management platform

PaidWebAPI
IN
OUT
Chainalysis icon

Chainalysis

Commercial blockchain intelligence platform

PaidWebAPI
IN
OUT
Cisco Talos Intelligence icon

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

FreeWeb
IN+2
OUT
Cortex icon

Cortex

an observable analysis and active response engine used with TheHive and secur

FreemiumOSSCLI
IN+2
OUT
CyberChef icon

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

FreeOSSCLI
IN+2
OUT
Feodo Tracker icon

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

FreeWeb
IN+2
OUT
Google Safe Browsing icon

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists

FreemiumWeb
IN+2
OUT
Group-IB Threat Intelligence icon

Group-IB Threat Intelligence

Russian-region-focused TI platform

PaidWebAPI
IN
OUT
IBM X-Force Exchange icon

IBM X-Force Exchange

a threat intelligence sharing and enrichment platform for indicators, malware

FreemiumWeb
IN+2
OUT
Kaspersky Threat Intelligence Portal icon

Kaspersky Threat Intelligence Portal

Kaspersky free IOC reputation portal

FreemiumWebAPI
IN
OUT
MISP icon

MISP

an open-source threat intelligence platform for sharing indicators, events, g

FreeOSSCLI
IN+2
OUT
Malpedia icon

Malpedia

Malware-family encyclopedia with YARA rules and actor links

FreeWebAPI
IN
OUT
MalwareBazaar Browse icon

MalwareBazaar Browse

Researcher-run malware archive (vx-underground)

FreeWeb
IN
OUT
Malwarebytes Labs icon

Malwarebytes Labs

a threat research publication and malware intelligence source for campaigns a

FreeWeb
IN+2
OUT
Mandiant Advantage icon

Mandiant Advantage

Mandiant TI and APT analytics platform

PaidWebAPI
IN+1
OUT
OpenCTI icon

OpenCTI

an open-source cyber threat intelligence platform for modeling entities, rela

FreeOSSCLI
IN+2
OUT
OpenPhish icon

OpenPhish

a phishing intelligence service that detects and publishes active phishing in

FreemiumWeb
IN+2
OUT
PhishTank icon

PhishTank

a community phishing verification service for checking and submitting suspect

FreeWeb
IN+2
OUT
Pulsedive icon

Pulsedive

a threat intelligence platform for enriching indicators, domains, IPs, and UR

FreemiumWeb
IN+2
OUT
QiAnXin TI icon

QiAnXin TI

QiAnXin Chinese TI portal

FreemiumWebAPI
IN
OUT
Recorded Future icon

Recorded Future

Recorded Future TI graph and risk platform

PaidWebAPI
IN+1
OUT
TheHive icon

TheHive

a scalable security incident response platform for case management and analys

FreemiumOSSCLI
IN+2
OUT
ThreatBook icon

ThreatBook

Chinese commercial TI platform

FreemiumWebAPI
IN
OUT
ThreatConnect icon

ThreatConnect

ThreatConnect TIP and SOAR platform

PaidWebAPI
IN
OUT
ThreatFox icon

ThreatFox

an abuse.ch platform for sharing malware indicators and command-and-control i

FreeWeb
IN+2
OUT
ThreatMiner icon

ThreatMiner

Free TI aggregator for IOC enrichment

FreeWebAPI
IN
OUT
ThreatQ icon

ThreatQ

ThreatQuotient TIP and investigation platform

PaidWebAPI
IN
OUT
Yeti icon

Yeti

an intelligence platform for organizing observables, indicators, entities, an

FreeOSSCLI
IN+2
OUT
abuse.ch Hunting icon

abuse.ch Hunting

Cross-platform IOC hunting over MalwareBazaar, ThreatFox, URLhaus and YARAify

FreeWebAPI
IN+1
OUT

From hash (md5/sha), also find…

IOC (Indicator of Compromise)61Report / Summary39Malware Sample24Relationship Map10Financial Records8Timeline / Chronology7Data Breach Records5SSL Certificate5

Find threat actor profile from other data

IP Address31Domain Name28URL20IOC (Indicator of Compromise)18Real Name5
All OSINT use cases & data types