malicious-hash

What the list contains

The malicious-hash repository aggregates lists of malicious file hashes gathered from published malware sources and splits them into files sized for direct use in firewalls. According to the README, the hashes are ordered by how many sources report them, so the entries that appear in the most sources sit at the beginning of each file, giving firewall operators a way to prioritize the most corroborated indicators. The files are capped at 131,072 entries each so they fit the limits of equipment that ingests threat feeds in fixed size chunks. As of the table in the README, the counts are 4,090 MD5 hashes, 605 SHA1 hashes, and 76,419 SHA256 hashes, and the author notes that hashes are not duplicated between the separate files, so each feed must be loaded on its own. The lists are meant for integration into Fortinet FortiGate firewalls and other products that accept external malware hash feeds. The project carries 52 stars and 6 forks and is maintained under the MIT license. Because the data is plain text hashes in predictable URLs, a security team can point a firewall or a script at the raw files and pull updates without any special client. The plain text format also lets a team diff feeds over time or mirror them internally without dedicated tooling. The focus is on practical blocking rather than analysis, which suits defenders who already run gear that consumes hash threat feeds.

How it integrates with FortiGate

The README gives step by step FortiGate integration using the malware hash threat feed feature. The path is Security Fabric, then External Connectors, then Create New, then Threat Feeds, then Malware Hash, where the operator copies one of the raw file URLs into the Links section. After that, the administrator goes to Security Profiles and AntiVirus, enables Use External Malware Block List, and applies that security profile to the firewall policy that allows outbound HTTP and HTTPS traffic from LAN to WAN. The README links the official FortiGate administration guide section that documents this feed type, so the steps track the vendor's own interface. Because each file must be implemented separately and the hashes are not duplicated across files, an operator should add the MD5, SHA1, and SHA256 URLs as three distinct feed entries to cover all three algorithms. The author maintains the project as a freelance cybersecurity expert focused on firewalls and notes he has kept it running since 2023 to help the community defend against threats. The hourly update cadence means a firewall pulling the feed will pick up new hashes without manual intervention, turning the repository into a near real time block list once the connector is configured and scheduled.

Sources and update cadence

The hashes come from several public malware tracking sources that the README lists. abuse.ch Malware Bazaar shares malware samples and has a 120 day history noted in the table. abuse.ch URLhaus covers payloads downloaded by malicious URLs less than a month old. The AlienVault OTX pulses include alienvault-malware-scan for malware detected less than four months ago and alienvault-ragnar-locker for the payloads of the RagnarLocker ransomware. The README also mentions an initial release on 2024-03-02 that started with bazaar.abuse.ch, urlhaus.abuse.ch, alienvault-malware-scan, alienvault-ragnar-locker, and Banco do Brasil. Aggregating from multiple feeds is what lets the project rank hashes by source count, since an entry seen across several feeds is more likely to be broadly malicious. The listing table at the top of the README is timestamped with the update of 2026-08-24, and the project states the data refreshes every hour, so the counts shown there move over time as sources report new samples. The hourly refresh keeps the feeds current without manual intervention by the operator. The MIT license covers the repository, which makes the lists free to use and redistribute within the terms of that license. A defender can therefore mirror the files internally or wire them straight into supported gear.

Editorial conclusion

The malicious-hash repository is published under the MIT license, refreshes every hour, and its SHA256 file alone held 76,419 hashes as listed in the README.