Statistics
MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.
You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.
| Rank | Reporter | Last activity | Submissions |
|---|---|---|---|
| 1 |  abuse_ch | 2025-05-07 | 4'767 |
| 2 |  JAMESWT_WT | 2025-05-07 | 240 |
| 3 |  SecuriteInfoCom | 2025-05-06 | 183 |
| 4 |  threatcat_ch | 2025-05-07 | 148 |
| 5 |  BastianHein | 2025-04-29 | 119 |
| 6 |  zhuzhu0009 | 2025-05-06 | 110 |
| 7 |  cocaman | 2025-05-06 | 96 |
| 8 |  adrian__luca | 2025-05-06 | 84 |
| 9 |  adm1n_usa32 | 2025-05-06 | 79 |
| 10 | aachum | 2025-05-02 | 71 |
| 11 |  TeamDreier | 2025-05-01 | 69 |
| 12 |  neiki_dev | 2025-05-07 | 66 |
| 13 |  smica83 | 2025-05-06 | 65 |
| 14 |  LuRisa323 | 2025-04-28 | 48 |
| 15 |  TheRavenFile | 2025-05-06 | 41 |
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 3'123 | Sus_Obf_Enc_Spoof_Hide_PE | XiAnzheng | 2025-05-07 |
| 2'124 | linux_generic_ipv6_catcher | @_lubiedo | 2025-05-07 |
| 1'610 | unixredflags3 | Tim Brown @timb_machine | 2025-05-07 |
| 1'097 | golang_bin_JCorn_CSC846 | Justin Cornwell | 2025-05-07 |
| 994 | upx_packed_elf_v1 | RandomMalware | 2025-05-07 |
| 957 | DebuggerCheck__API | None | 2025-05-07 |
| 951 | NET | malware-lu | 2025-05-07 |
| 812 | Skystars_Malware_Imphash | Skystars LightDefender | 2025-05-07 |
| 812 | pe_imphash | None | 2025-05-07 |
| 794 | RANSOMWARE | ToroGuitar | 2025-05-07 |
| 786 | SUSP_ELF_LNX_UPX_Compressed_File | Florian Roth (Nextron Systems) | 2025-05-07 |
| 708 | Linux_Trojan_Gafgyt_28a2fe0c | Elastic Security | 2025-05-06 |
| 598 | NETexecutableMicrosoft | malware-lu | 2025-05-07 |
| 573 | pe_detect_tls_callbacks | None | 2025-05-07 |
| 538 | setsockopt | Tim Brown @timb_machine | 2025-05-07 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
xlsx
doc
Anonymous
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
CyberFortress
Top classifications by CyberFortress for malware samples on MalwareBazaar.
ThreatZone
Top classifications by ThreatZone for malware samples on MalwareBazaar.
Top File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 16 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgF:25WOSACZSV6eKRH5EPiamb4DsDwwcV | Prometei |
| 16 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcA | Prometei |
| 13 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgY:25WOSACZSV6eKRH5EPiamb4DsDwwcI | Prometei |
| 13 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgH:25WOSACZSV6eKRH5EPiamb4DsDwwcX | Prometei |
| 13 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgT:25WOSACZSV6eKRH5EPiamb4DsDwwcD | Prometei |
| 12 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwcC | Prometei |
| 12 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgi:25WOSACZSV6eKRH5EPiamb4DsDwwcy | Prometei |
| 12 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgZ:25WOSACZSV6eKRH5EPiamb4DsDwwcJ | Prometei |
| 11 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgC:25WOSACZSV6eKRH5EPiamb4DsDwwcS | Prometei |
| 10 | 6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcK | Prometei |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 132 | aae2f3e38383b629 | 40 x Formbook, 28 x Amadey, 15 x CredentialFlusher |
| 49 | e4f6b2f0e8ccf0f0 | 1 x CoinMiner |
| 42 | 926b23534d61338c | 41 x Rhadamanthys |
| 36 | f8f0f4c8c8c8d8f0 | 18 x Amadey, 6 x CredentialFlusher, 5 x LummaStealer |
| 34 | 9494b494d4aeaeac | 24 x DCRat, 1 x RedLineStealer, 1 x NetSupport |
| 33 | 60dc862226869ce1 | 33 x Neconyd |
| 25 | 33b2cd4d17174db2 | 25 x GCleaner |
| 22 | f8ba6c0e0ec982c0 | 22 x Blackmoon |
| 20 | 5050d270cccc82ae | 4 x OffLoader, 3 x ValleyRAT, 3 x LummaStealer |
| 20 | b170e88e8e8c6860 | 5 x Formbook, 5 x MassLogger, 4 x SnakeKeylogger |
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.
| Rank | Reporter | Last activity | Submissions |
|---|---|---|---|
| 1 | abuse_ch | 2025-05-07 | 224'149 |
| 2 |  zbetcheckin | 2024-11-09 | 78'688 |
| 3 |  lazyactivist192 | 2024-01-17 | 69'729 |
| 4 |  Cryptolaemus1 | 2024-03-20 | 67'837 |
| 5 |  seifreed | 2021-10-19 | 48'947 |
| 6 | JAMESWT_WT | 2025-05-07 | 40'535 |
| 7 | SecuriteInfoCom | 2025-05-06 | 38'486 |
| 8 |  andretavare5 | 2024-01-18 | 35'831 |
| 9 | cocaman | 2025-05-06 | 30'539 |
| 10 |  Libranalysis | 2024-01-17 | 17'035 |
| 11 |  GovCERT_CH | 2024-10-18 | 15'559 |
| 12 |  lowmal3 | 2025-04-29 | 13'873 |
| 13 | adrian__luca | 2025-05-06 | 11'178 |
| 14 |  James_inthe_box | 2025-05-06 | 9'870 |
| 15 |  Bitsight | 2025-04-02 | 9'779 |
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 120'309 | Skystars_Malware_Imphash | Skystars LightDefender | 2025-05-07 |
| 83'533 | pe_imphash | None | 2025-05-07 |
| 78'505 | SharedStrings | Katie Kleemola | 2025-04-04 |
| 76'712 | Email_stealer_bin_mem | James_inthe_box | 2024-06-13 |
| 74'505 | Select_from_enumeration | James_inthe_box | 2025-01-23 |
| 73'333 | UAC_bypass_bin_mem | James_inthe_box | 2023-03-07 |
| 71'651 | IPPort_combo_mem | James_inthe_box | 2025-03-26 |
| 56'853 | unixredflags3 | Tim Brown @timb_machine | 2025-05-07 |
| 55'960 | linux_generic_ipv6_catcher | @_lubiedo | 2025-05-07 |
| 51'176 | pe_imphash | 2025-05-07 | |
| 45'508 | Cobalt_functions | @j0sm1 | 2023-08-23 |
| 45'261 | NET | malware-lu | 2025-05-07 |
| 40'141 | DebuggerCheck__API | None | 2025-05-07 |
| 32'215 | Sus_Obf_Enc_Spoof_Hide_PE | XiAnzheng | 2025-05-07 |
| 31'954 | pdb_YARAify | @wowabiy314 | 2025-01-05 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
exe
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
CyberFortress
Top classifications by CyberFortress for malware samples on MalwareBazaar.
ThreatZone
Top classifications by ThreatZone for malware samples on MalwareBazaar.
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.
htaTop File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 1'124 | 12288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4 | Quakbot |
| 1'123 | 12288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4 | Quakbot |
| 1'121 | 12288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4 | Quakbot |
| 528 | 1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz | SilentBuilder Heodo |
| 419 | 1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz | SilentBuilder Heodo |
| 416 | 768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6 | SilentBuilder Heodo |
| 401 | 1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8 | SilentBuilder Heodo |
| 373 | 3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2 | Gozi Heodo |
| 351 | 3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P | SilentBuilder Heodo |
| 307 | 12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml | TrickBot |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 15'326 | f8f0f4c8c8c8d8f0 | 8'801 x RedLineStealer, 5'060 x Amadey, 288 x Smoke Loader |
| 5'725 | b2a89c96a2cada72 | 2'283 x Formbook, 981 x Loki, 800 x AgentTesla |
| 5'406 | aae2f3e38383b629 | 1'522 x Formbook, 1'158 x CredentialFlusher, 553 x AgentTesla |
| 4'800 | b298acbab2ca7a72 | 2'327 x GCleaner, 1'607 x Socks5Systemz, 67 x RedLineStealer |
| 3'897 | 71b119dcce576333 | 3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT |
| 3'061 | 0000000000000000 | 849 x AgentTesla, 440 x Formbook, 275 x RedLineStealer |
| 2'700 | 848c5454baf47474 | 2'086 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox |
| 1'958 | 9494b494d4aeaeac | 734 x DCRat, 172 x RedLineStealer, 134 x CryptOne |
| 1'150 | fefce49e86c0fcfe | 884 x Socks5Systemz, 259 x RaccoonStealer |
| 1'070 | 399998ecd4d46c0e | 572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker |
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.