Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated.
➡️ Read here for more info

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-08-284'664
2 JAMESWT_WT2025-08-28439
3 SecuriteInfoCom2025-08-28278
4 burger2025-08-28247
5 aachum2025-08-28243
6 cocaman2025-08-28136
7 jstrosch2025-08-26124
8 smica832025-08-28111
9 AntiSkidding2025-08-28105
10 Joker2025-08-27104
11 lowmal32025-08-2892
12 threatcat_ch2025-08-2889
13 zhuzhu00092025-08-2167
14 FXOLabs2025-08-2838
15 James_inthe_box2025-08-2533

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
3'879CP_AllMal_DetectorDiegoAnalytics2025-08-28
3'067Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-08-28
1'930unixredflags3Tim Brown @timb_machine2025-08-28
1'629linux_generic_ipv6_catcher@_lubiedo2025-08-28
1'331golang_bin_JCorn_CSC846Justin Cornwell2025-08-28
1'196DebuggerCheck__APINone2025-08-28
1'114Sus_CMD_Powershell_UsageXiAnzheng2025-08-28
948CP_Script_Inject_DetectorDiegoAnalytics2025-08-28
849NETmalware-lu2025-08-28
822DetectEncryptedVariantsZinyth2025-08-28
785Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-08-28
773pe_detect_tls_callbacksNone2025-08-28
750botnet_plaintext_c2cip2025-08-28
749upx_packed_elf_v1RandomMalware2025-08-28
746ELF_MiraiNDA0E2025-08-28

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
1'784c0bd18efb507d677ccaafc069c5a33fd865105369029b25dbfd2f41d7098f587Executable exeValleyRAT zhuzhu0009
1'30421382b355d4a7397b8d05e9ae2bb922fda100da0d30a211409454978718c0f65Executable exeNodeLoader AntiSkidding
1'22949ed932f63da983f539be7f5f6463e96f66f56b37416f1ed3af363449c754818Visual Basic Script (vbs) vbs  dodosec
839f4e59d8cd60f7ab60b877af61cb4424964050adb7acd0edbf11c23dfe32966cdExecutable exeValleyRAT zhuzhu0009
7878d1db6511eb46ad8b9c00d732b1e45ae7a962bb1f6fea0ed53184d3fd5f89a09Executable exe  burger
7829f9f4a84b0543ca1b2a5d8d67badb571133b99d7ca5c367208d98fdea26abebcExecutable exeRhadamanthys aachum
77206932f92b0d128f563401e7566722d3202c8d99ae91aa4dfe670cb4c4db25470Executable exeRhadamanthys aachum
685e3010b3f1406669e3209e62c6a7cdcac45a218226672b11257e121fa2d18b4d7Executable exeNodeLoader aachum
604f300878883a85fd1ad352a40ecb9b015fdd4f423603a90c1509df8a39464bdd3Executable exeLummaStealer aachum
5573db0bd4805036701a3f31c61a988e14c319638f11a7456d5a6d0e78e6ca793c6Executable exeRhadamanthys GDHJDSYDH1
487fd9a978cfddf57aa0fc20fb70534f302c7dc013b6f038f8e46e7dbe82c57fe2eExecutable exeLummaStealer aachum
4241e4a4d59daabb00822230cec30c8444738f9fc96400729ca69ad7d4c62df660eExecutable exe  burger
420dfc7ea246a14e77ff04a324f67544cf6b81ac71d21a20015018c33cb5663aac0Executable exe  burger
3794979fec3dddf3013e7741f03714f36c1a2be3ea1f782137cbd6344cf60130006Executable exeRhadamanthys aachum
302da7186a612fb3cd3416b950c3584c3de83c8c7e41bd7071f21f82e32c0879448PowerShell (PS) ps1Rhadamanthys GDHJDSYDH1

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
652f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
53c32ba42c73a2bc24d2788f7750d87edbLummaStealer Rhadamanthys
37b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT EpsilonStealer AgentTesla
331895460fffad9475fda0c84755ecfee1Formbook AgentTesla QuasarRAT RemcosRAT
30112bfbb18727302cb5425c20a464b02eXWorm
296ed4f5f04d62b18d96b26d6db7c18840SalatStealer BitRAT RedLineStealer TriumphLoader
298d6a06a9946b41554b4eabd6890d8c46LummaStealer Rhadamanthys Stealc DeerStealer
298c16c795b57934183422be5f6df7d891Mofksys CryptOne AveMariaRAT QuasarRAT
27b729b61eb1515fcf7b3e511e4e66258bLummaStealer Rhadamanthys Adware.Generic Amadey
25dcaf48c1f10b0efa0a4472200f3850edBlankGrabber SalatStealer PySilonRAT RedTigerStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
8768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZMirai
8768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8Mirai
81536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7hMirai
51536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKKMirai
398304:HfNhGcw1iOVVNkdbMkCI/WMId0a7eVxF3mvZVmqkNQ6FcLx:HVQrlkMn5eVYyQt
324576:NS9fG4dk3YS3BY5STToqCB5e7gtdcY8tve+U8BHVypeZa+LjhZS8UaOkBezm:NS9f03W5eT6hgvxrEevhZS8UaOkBeMystRodX
33072:cowpuQyNSG2eRa1styK9flTQPHoOrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIOrSmM/9ndMirai
31536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeZNY0:lZzTJa1rZ62yqPy/ULWzjeZNPMirai
21536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAu4:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjA/Mirai
224576:ulr5OQBg2qLHMs+UFYGPgmjF+WvAs4wR7tFDJKTRzpMSMhBA3KO:ulr5OQUH+GoYRDJuzorAaOLummaStealer

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
399494b494d4aeaeac6 x DCRat, 3 x LummaStealer, 1 x SalatStealer
32aae2f3e38383b62917 x Formbook, 4 x RemcosRAT, 3 x RedLineStealer
21c6c2ccc4f4e0e0f81 x njrat, 1 x QuasarRAT, 1 x ResolverRAT
19399998ecd4d46c0e17 x GCleaner, 2 x LummaStealer
1700928e8e8686b80017 x Mofksys
16d8dedfe6d692b3b016 x ValleyRAT
14e0e1e4aeb8aea02014 x CoinMiner
12000000a2800000004 x MassLogger, 2 x RemcosRAT, 2 x Formbook
12b574b4dcccd4c4d4n/a
1200000000000000002 x LummaStealer, 2 x RedLineStealer, 2 x MassLogger

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-08-28260'234
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-08-2844'103
7 SecuriteInfoCom2025-08-2840'537
8 andretavare52024-01-1835'831
9 cocaman2025-08-2831'429
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-08-2814'757
13 adrian__luca2025-08-2614'003
14 James_inthe_box2025-08-2510'184
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
127'762Skystars_Malware_ImphashSkystars LightDefender2025-08-28
90'988pe_imphashNone2025-08-28
78'518SharedStringsKatie Kleemola2025-08-20
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
76'433unixredflags3Tim Brown @timb_machine2025-08-28
74'649linux_generic_ipv6_catcher@_lubiedo2025-08-28
74'506Select_from_enumerationJames_inthe_box2025-07-30
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'651IPPort_combo_memJames_inthe_box2025-03-26
69'490Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-08-28
55'667NETmalware-lu2025-08-28
53'042DebuggerCheck__APINone2025-08-28
51'179pe_imphash2025-08-28
45'508Cobalt_functions@j0sm12023-08-23
31'955pdb_YARAify@wowabiy3142025-08-19

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34559494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'686c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'662b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6799fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5701509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'5702ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'559a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'786cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'491eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'454515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
24'726b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki
24'7124e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
148'955f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'677646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'4272eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'797884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'377afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'62487bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'29861259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'107948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
52612288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
41012288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
40812288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
40112288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'390f8f0f4c8c8c8d8f08'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader
6'664aae2f3e38383b6292'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla
5'757b2a89c96a2cada722'283 x Formbook, 981 x Loki, 803 x AgentTesla
4'862b298acbab2ca7a722'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer
3'90071b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'3730000000000000000872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer
2'708848c5454baf474742'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'3329494b494d4aeaeac832 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'172399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer