Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated.
➡️ Read here for more info

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-08-083'783
2 JAMESWT_WT2025-08-07635
3 aachum2025-08-06290
4 burger2025-08-07269
5 AntiSkidding2025-08-07204
6 SecuriteInfoCom2025-08-07177
7 cocaman2025-08-07148
8 skocherhan2025-08-08131
9 threatcat_ch2025-08-08119
10 zhuzhu00092025-08-08118
11 lowmal32025-08-07113
12 Joker2025-08-0699
13 smica832025-08-0787
14 James_inthe_box2025-08-0545
15 FXOLabs2025-08-0844

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
3'181Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-08-08
1'582unixredflags3Tim Brown @timb_machine2025-08-08
1'507golang_bin_JCorn_CSC846Justin Cornwell2025-08-08
1'359DebuggerCheck__APINone2025-08-08
1'293linux_generic_ipv6_catcher@_lubiedo2025-08-08
1'030Sus_CMD_Powershell_UsageXiAnzheng2025-08-08
1'008NETmalware-lu2025-08-08
912pe_detect_tls_callbacksNone2025-08-08
883DetectEncryptedVariantsZinyth2025-08-08
836Skystars_Malware_ImphashSkystars LightDefender2025-08-08
836pe_imphashNone2025-08-08
735Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-08-08
690ELF_MiraiNDA0E2025-08-08
657botnet_plaintext_c2cip2025-08-08
646RANSOMWAREToroGuitar2025-08-08

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
2'2488499e9ee59a5bd8a7e38581849852339b0ac3c8a803a7127e8cd9cd4833ab7fbExecutable exeSliverFox zhuzhu0009
1'971d351b74eecc10bace9187414a58dbee901b0486c185a2473def879c0f789054dExecutable exe  Joker
1'7785a25296d8dbb035ae61c44d4f006559909e5035fd97d4f7f8317a37217dc51e7Executable exeSliverFox zhuzhu0009
1'308a4f7ccbb012ae3d8885c94a477d9c8301c8dc23789dd2c88bb32a29e40383bb7Executable exeValleyRAT zhuzhu0009
1'0246299d8caeadde2bf5c7349e985563df273c88950c921702a89a238e374fa44faExecutable exeSliverFox zhuzhu0009
711f653cf1bfccc4f45693e162b27762f4d7b083c0f148a4f47155d5605994f73eeExecutable exe  aachum
6719bfa6c3286016e5d8a81b7900a25c525e12fc5e3bb060325d9e0504be68eac74Executable exeLummaStealer aachum
548689f30f1d8dacfa027965ac617d475f769ab162b628bad37ff2833c61dc6917aExecutable exeLummaStealer aachum
508e65604fccb62db5af6d5c57cad37768cb0773f9ccb1826f04d2ad2fd9658b5b1Executable exeLummaStealer aachum
50839898c03d3dbd00fcb404c70ef65ce8f1dce2273b5ee85c78dc3fdd7063998c0Executable exeSliverFox zhuzhu0009
4723d8f800cd742cd1d3bc00d68aaa4c9b2d2be2fdd6d9870e0f8261cf42ecaf2dbExecutable exeSliverFox zhuzhu0009
45909dbeb3b5b6ffc6bb0550270dd13306329e6f02fd83657b3965b7488e3221190Executable exeLummaStealer aachum
355dd91b3a76d63915b30752334e7f6da6592e012bf8d9627c432392b4348075342Executable exeLummaStealer aachum
3487e7be5bc5707ea453adf4dd6f6de8b46dc1ecd6c9b998269a44ce29d29cb11e3Executable exeSliverFox zhuzhu0009
3479312c573b2a6c644aba599798a389fa23662239a8aef023c8a6c6546c6a84b9dExecutable exeSliverFox zhuzhu0009

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
737f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
11932f3282581436269b3a75b6675fe3e08LummaStealer Rhadamanthys CoinMiner GuLoader
943d95adbf13bbe79dc24dccb401c12091AgentTesla FormBook SnakeKeylogger NanoCore
46c990338f8145dc29c6f38fb73cf05c77BlankGrabber PythonStealer DiscordTokenStealer ValleyRAT
4312e12319f1029ec4f8fcbed7e82df162DCRat RedLineStealer Formbook SnakeKeylogger
4194d8ff6057177a8611280e66cadf0c19LummaStealer CoinMiner Rhadamanthys Stealc
39d42595b695fc008ef2c56aabd8efd68eCobaltStrike LummaStealer Sliver CoinMiner
386ed4f5f04d62b18d96b26d6db7c18840SalatStealer BitRAT RedLineStealer TriumphLoader
282eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
27147a71fba2b52ee8ebd7b7cf32b9e1d5LummaStealer DarkCloud Stealc CoinMiner

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
9768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZMirai
91536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7hMirai
8768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8Mirai
349152:lj3Yv0zatSUXHxJzP4h7r2iJ53sskJ2otak+FgnzcD4q:d3V+X3nQhl5yJ2ot6McDCRat
349152:zoZsprea4tennxACMcV9TeODipVIOUK0h/QUTPKdnn1ZMp9SCr60f/rZVdyueSM2:nprf4Mxj/9TrMI+0hYNdn1ZMpBrXZfK6DCRat
21536:daT/uMkOtg9iYv2ZKsT5Z7BPxznCI0sCp8udC:dWVkwgAYugsz9xznsxrdCMirai
21536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMkMirai
21536:WpaZOuT/Q30SQXa1r3J62yqPy/RWLW0edmpwjeONY0:lZzTJa1rZ62yqPy/ULWzjeONPMirai
2192:5WVNktpR/Uwghd43ZYfhGwcdhrstMMGbOvHfSeuA1bwHVyIiyerNd:52k1UjsZY5GwE5IfGb0fSed1bwHzfYXTinyLoader
224576:uSr6CK7SfjlaTM8tjmaGFMeyOqIpGFi7jmaGFMeyOqIpGFi8:p6H7qjUj3VPLIpGw7j3VPLIpGw8LummaStealer

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
80aae2f3e38383b62934 x Formbook, 14 x SnakeKeylogger, 7 x AgentTesla
529494b494d4aeaeac11 x DCRat, 4 x HijackLoader, 2 x RemcosRAT
38399998ecd4d46c0e35 x GCleaner, 3 x LummaStealer
3600000000000000008 x XWorm, 5 x RedLineStealer, 5 x SnakeKeylogger
24aebc385c4ce0e8f83 x QuasarRAT, 2 x PythonStealer, 1 x Cybergate
22d9b8e8e8e96982ce5 x SnakeKeylogger, 4 x AgentTesla, 4 x Formbook
21c6c2ccc4f4e0e0f82 x PythonStealer, 2 x RedTigerStealer, 2 x SVCStealer
2000e425252425e4008 x SnakeKeylogger, 4 x Formbook, 2 x AgentTesla
184c36f2cca3dc949c7 x SnakeKeylogger, 2 x MassLogger, 2 x a310Logger
15c4d48eaa8ad4d4f815 x RemcosRAT

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-08-08253'745
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-08-0743'400
7 SecuriteInfoCom2025-08-0740'191
8 andretavare52024-01-1835'831
9 cocaman2025-08-0731'293
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-08-0714'611
13 adrian__luca2025-08-0313'360
14 James_inthe_box2025-08-0510'126
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
126'404Skystars_Malware_ImphashSkystars LightDefender2025-08-08
89'630pe_imphashNone2025-08-08
78'516SharedStringsKatie Kleemola2025-08-02
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
74'506Select_from_enumerationJames_inthe_box2025-07-30
73'702unixredflags3Tim Brown @timb_machine2025-08-08
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
72'360linux_generic_ipv6_catcher@_lubiedo2025-08-08
71'651IPPort_combo_memJames_inthe_box2025-03-26
64'460Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-08-08
54'097NETmalware-lu2025-08-08
51'178pe_imphash2025-08-08
51'099DebuggerCheck__APINone2025-08-08
45'508Cobalt_functions@j0sm12023-08-23
31'954pdb_YARAify@wowabiy3142025-01-05

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34559494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'684c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'661b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6789fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5691509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'5692ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'558a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'780cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'490eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'453515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
24'717b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki
24'7044e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
147'740f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'659646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'3942eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'783884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'377afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'62487bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'29561259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'107948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
52612288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
41012288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
40812288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
40112288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'376f8f0f4c8c8c8d8f08'802 x RedLineStealer, 5'074 x Amadey, 288 x Smoke Loader
6'497aae2f3e38383b6291'967 x Formbook, 1'183 x CredentialFlusher, 645 x AgentTesla
5'757b2a89c96a2cada722'283 x Formbook, 981 x Loki, 803 x AgentTesla
4'853b298acbab2ca7a722'327 x GCleaner, 1'625 x Socks5Systemz, 67 x RedLineStealer
3'89971b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'3410000000000000000870 x AgentTesla, 490 x Formbook, 293 x RedLineStealer
2'706848c5454baf474742'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'2689494b494d4aeaeac824 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'140399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 55 x GCleaner