Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated.
➡️ Read here for more info

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-135'362
2 adrian__luca2025-07-08707
3 SecuriteInfoCom2025-07-13185
4 aachum2025-07-11169
5 skocherhan2025-07-11153
6 lowmal32025-07-11117
7 threatcat_ch2025-07-12116
8 JAMESWT_WT2025-07-09110
9 cocaman2025-07-11106
10 burger2025-07-1284
11 GDHJDSYDH12025-07-1381
12 smica832025-07-1261
13 mohit2025-06-3047
14 FXOLabs2025-07-1142
15 antigdi2025-07-1336

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
3'707Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-13
3'160unixredflags3Tim Brown @timb_machine2025-07-13
2'569linux_generic_ipv6_catcher@_lubiedo2025-07-13
1'188golang_bin_JCorn_CSC846Justin Cornwell2025-07-13
1'147NETmalware-lu2025-07-13
1'105DebuggerCheck__APINone2025-07-13
980enterpriseapps2Tim Brown @timb_machine2025-07-13
861Skystars_Malware_ImphashSkystars LightDefender2025-07-13
861pe_imphashNone2025-07-13
844Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-07-13
835ELF_MiraiNDA0E2025-07-13
833Sus_CMD_Powershell_UsageXiAnzheng2025-07-13
813DetectEncryptedVariantsZinyth2025-07-13
796pe_detect_tls_callbacksNone2025-07-13
684botnet_plaintext_c2cip2025-07-13

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
3'7904f9f55fa6fd5601245068c412d1d458928de826e6d02362c1ff62ca6bd8891a7Excel file xlsx  abuse_ch
3'64801d12781392070c3326fbbe214b0562ba6bf2f02521e017c41780289dcbd227fExcel file xlsxFormbook abuse_ch
3'61454be816c4ffe69d6d52950f885f20f9566f6b209c479e01569af6ed6d641c91eExcel file xlsxSnakeKeylogger abuse_ch
3'49736828491280f3a41e3ce675cfcbbb85257a7b65e367f3df62992b57e459e99b5Word file doc  lowmal3
2'693b19f1f290f5baf67e4b542fbf778adc04984a55a7f05eb9b1a26adeafeaeece3Excel file xlsxMassLogger abuse_ch
1'690af747282bf8a68dbd5d4b5db4fafbba61d0a418e27d62090844f36d039bef1f0Executable exe  SecuriteInfoCom
1'367cbd1db1d117054fc747b0ce39a7ca8f260824c408a30d8a27ac36c8d0b6b18de apk  mohit
1'051872caeac3567b129ba58a84abfdd36064ecb6f3dd6538b2cc844c12431a8d106Executable exeValleyRAT GDHJDSYDH1
1'012a74543dfa11f5d57c7bbb586613d40daab0e8227aec7b787761dcd5228f4fa5fExecutable exeLummaStealer aachum
9900fad716dfb636e95feaf6b54f018d3b3337542970da77f7ef63de473fceaaf96 apk  mohit
78107897be894f90e837ac00edd367ff159c9f9153749743aa699e471a7d07f7ce4Executable exeFormbook threatcat_ch
7462740e9c875b6d70c61a6bbe6793d5820ca89ed0a479ff85c68dcbed917545d8eExecutable exeFormbook threatcat_ch
739fd6cffce948aff9c17134a6d29b5ba7722e65a7b385abef06fb357cd2b32b1e2Executable exeAgentTesla lowmal3
733568e9427d77bbc71e8b1537c3668671cf65454c5596328f2a9317236c96a5597Executable exeLummaStealer antigdi
7217b718b0293b6665fae6296da12329485e3a4ba430ca5d15ccbe86a251f27757eExecutable exeVIPKeylogger FXOLabs

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
729f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
1710b768923437678ce375719e30b21693eFormbook MassLogger SnakeKeylogger AgentTesla
1333d95adbf13bbe79dc24dccb401c12091AgentTesla FormBook SnakeKeylogger NanoCore
79bf95d1fc1d10de18b32654b123ad5e1fLummaStealer Rhadamanthys Vidar ACRStealer
592eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
54b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT EpsilonStealer AgentTesla
326e7f9a29f2c85394521a08b9f31f6275GuLoader AgentTesla RemcosRAT VIPKeylogger
30f4639a0b3116c2cfc71144b88a929cfdGuLoader Formbook VIPKeylogger Stealc
24d42595b695fc008ef2c56aabd8efd68eCobaltStrike Sliver CoinMiner LummaStealer
203abe302b6d9a1256e6a915429af4ffd2GuLoader Formbook Loki RemcosRAT

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
12812288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB
12812288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
12712288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
12612288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+
12612288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
12412288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
1246144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
12312288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
61536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7hMirai
6768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8Mirai

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
255aae2f3e38383b629128 x Formbook, 26 x SnakeKeylogger, 20 x AgentTesla
57000000000000000017 x Formbook, 12 x SnakeKeylogger, 4 x MassLogger
249494b494d4aeaeac11 x DCRat, 1 x Stealc, 1 x NanoCore
17306296163498f2306 x SnakeKeylogger, 1 x a310Logger, 1 x XWorm
1569c8c4a68e88f0c45 x SnakeKeylogger, 4 x XWorm, 4 x Formbook
14a25337335bbb1bba5 x SnakeKeylogger, 3 x Formbook, 2 x VIPKeylogger
1340b974c4d46028586 x Formbook, 3 x SnakeKeylogger, 2 x a310Logger
1230cecaccccccce3012 x ValleyRAT
12f0e8ccb2d4d4f0f07 x Formbook, 2 x RemcosRAT, 1 x MassLogger
1270f0fefefefef83011 x VIPKeylogger, 1 x GuLoader

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-13246'003
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-07-0942'502
7 SecuriteInfoCom2025-07-1339'871
8 andretavare52024-01-1835'831
9 cocaman2025-07-1131'042
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-07-1114'411
13 adrian__luca2025-07-0813'260
14 James_inthe_box2025-07-0810'040
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
125'026Skystars_Malware_ImphashSkystars LightDefender2025-07-13
88'252pe_imphashNone2025-07-13
78'515SharedStringsKatie Kleemola2025-06-30
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
74'505Select_from_enumerationJames_inthe_box2025-01-23
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'651IPPort_combo_memJames_inthe_box2025-03-26
70'054unixredflags3Tim Brown @timb_machine2025-07-13
69'563linux_generic_ipv6_catcher@_lubiedo2025-07-13
58'830Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-13
52'408NETmalware-lu2025-07-13
51'178pe_imphash2025-07-13
48'750DebuggerCheck__APINone2025-07-13
45'508Cobalt_functions@j0sm12023-08-23
31'954pdb_YARAify@wowabiy3142025-01-05

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34559494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'680c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'660b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6789fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5691509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'5692ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'558a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'775cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'490eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'453515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
24'717b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki
24'7034e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
146'567f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'642646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'3562eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'764884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'373afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'62387bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'29261259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'106948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
50412288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
4011536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8SilentBuilder Heodo
38812288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
38312288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'359f8f0f4c8c8c8d8f08'802 x RedLineStealer, 5'069 x Amadey, 288 x Smoke Loader
6'332aae2f3e38383b6291'898 x Formbook, 1'183 x CredentialFlusher, 628 x AgentTesla
5'756b2a89c96a2cada722'283 x Formbook, 981 x Loki, 803 x AgentTesla
4'835b298acbab2ca7a722'327 x GCleaner, 1'616 x Socks5Systemz, 67 x RedLineStealer
3'89971b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'2910000000000000000869 x AgentTesla, 487 x Formbook, 287 x RedLineStealer
2'704848c5454baf474742'087 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'1899494b494d4aeaeac805 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'092399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker