NEW | Hunt across all abuse.ch platforms with one simple query - discover if an IPv4 address, domain, URL or file hash has been identified on any platform from a centralized search tool. Test it out here hunting.abuse.ch - and happy hunting 🔍

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-05-284'788
2 JAMESWT_WT2025-05-28437
3 skocherhan2025-05-28272
4 aachum2025-05-28241
5 SecuriteInfoCom2025-05-28217
6 burger2025-05-28134
7 lowmal32025-05-28108
8 smica832025-05-2880
9 BastianHein2025-05-2864
10 elfdigest2025-05-2346
11 adrian__luca2025-05-2742
12 GDHJDSYDH12025-05-2841
13 FXOLabs2025-05-2839
14 James_inthe_box2025-05-2835
15 cocaman2025-05-2832

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
2'539Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-05-28
1'897linux_generic_ipv6_catcher@_lubiedo2025-05-28
1'313unixredflags3Tim Brown @timb_machine2025-05-28
999upx_packed_elf_v1RandomMalware2025-05-28
878golang_bin_JCorn_CSC846Justin Cornwell2025-05-28
792Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-05-28
757NETmalware-lu2025-05-28
750DebuggerCheck__APINone2025-05-28
713SUSP_ELF_LNX_UPX_Compressed_FileFlorian Roth (Nextron Systems)2025-05-28
600RANSOMWAREToroGuitar2025-05-28
554ELF_MiraiNDA0E2025-05-28
531pe_imphashNone2025-05-28
531Skystars_Malware_ImphashSkystars LightDefender2025-05-28
496pe_detect_tls_callbacksNone2025-05-28
459Linux_Trojan_Gafgyt_ea92cca8Elastic Security2025-05-28

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
7'990e04fcd521b4f8748705e8361cedcb809c097b2dcb4689ea447b553495ee17d2d apk Twitter Anonymous
7'465fe54167868c6f13410ec5eec4f7ccde08a4638c3a95e766b57834eb4ab436bea apk  JAMESWT_WT
6'278f690e30b6ee25c153effc5620fd7ec61481a449a127b54a67c7afc4c13d7917f apk  5KidRo0t
5'546afeec998101aab2324b287fa615009ba6fb819999c07e41cc8bdbbe0339b2a76Executable exeRhadamanthys aachum
5'46561a704a72bffa9a327a884f4f8cd812f114ea400db66a85988528e08b583ddbf apk  Shokitex
5'23507f6fad0ab8e5dad71d6526b4033056b9ed7ae1110998d5fd2a7e2bd4f92d452 apk  smog
4'67257b9744b30903c7741e9966882815e1467be1115cbd6798ad4bfb3d334d3523dWord file docSideWinder smica83
4'641bc7cae6ebd0b3c7a2f69b35bc954efb17393528d4420c9d103d2fa362d225b15Excel file xlsxFormbookTwitter Anonymous
4'577c386af35bc183ea3251b0ae8b742c6e8e2fbcf127ef8c543548caebac15189e3Excel file xlsxFormbook lowmal3
4'48658ac130a8ebb09e37592ac69841483edc5695d1545b1f04f23d5b760ac17cd94 apk  CAGSBT
4'393b3d154f28e1768e57b3af885720e979f51fcdd5a3d5800149f28483e6ca389e5Excel file xlsxFormbook lowmal3
4'3625f63a262905b745a9a3476b3b347115b27e0ff73922333e6b90e7313497dab39Word file docSideWinder smica83
4'245b6b98197133a19a20ef64d6206e4b0e98d8d9db00d66a643577f5d55e00ea58dWord file docSideWinder smica83
4'2252e41e81c5b5a0aadd477d0124b0e6c197fc7f7aa4b26f5609b0762c4e04f144fExcel file xlsxSnakeKeylogger abuse_ch
4'22155fee116c6f4b42f0df40a8ba9e688477f62a01419db3624fcf5e8f1eff01adbExcel file xlsx  abuse_ch

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
527f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
1572eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
1033d95adbf13bbe79dc24dccb401c12091AgentTesla FormBook NanoCore SnakeKeylogger
7812e12319f1029ec4f8fcbed7e82df162DCRat RedLineStealer Formbook SnakeKeylogger
66bf95d1fc1d10de18b32654b123ad5e1fLummaStealer Vidar Rhadamanthys ACRStealer
45948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer
293642c4ad9797c59f810541c9ea7d8d9aLummaStealer Stealc XWorm
26d42595b695fc008ef2c56aabd8efd68eCobaltStrike Sliver LummaStealer SkuldStealer
24cc56030055f1b3ec9cc1fa678dfddfd9LummaStealer
20965e162fe6366ee377aa9bc80bdd5c65BlankGrabber ExelaStealer PythonStealer DiscordTokenStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
7612288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
191536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7hMirai
18768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8Mirai
18768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZMirai
106144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwcYPrometei
96144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgD:25WOSACZSV6eKRH5EPiamb4DsDwwcTPrometei
96144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwcbPrometei
86144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgU:25WOSACZSV6eKRH5EPiamb4DsDwwcEPrometei
86144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcxPrometei
86144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcFPrometei

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
118aae2f3e38383b62923 x Amadey, 23 x SnakeKeylogger, 21 x Formbook
869494b494d4aeaeac19 x DCRat, 2 x CoinMiner, 1 x SheetRAT
37c4d48eaa8ad4d4f836 x RemcosRAT, 1 x Expiro
3500000000000000005 x MassLogger, 4 x AgentTesla, 3 x SnakeKeylogger
195050d270cccc82ae6 x Vidar, 2 x ACRStealer, 1 x DCRat
187ffedaf6e6e4d0c05 x SnakeKeylogger, 4 x Formbook, 3 x MassLogger
1670f8d4d6cc6830587 x SnakeKeylogger, 4 x Formbook, 2 x MassLogger
1500404049717168005 x SnakeKeylogger, 3 x Formbook, 3 x AgentTesla
14c6c2ccc4f4e0e0f81 x PythonStealer, 1 x LummaStealer, 1 x AsyncRAT
11b2e1b496a6cada724 x ACRStealer, 3 x AurotunStealer, 2 x CoinMiner

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-05-28231'562
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-05-2841'193
7 SecuriteInfoCom2025-05-2838'815
8 andretavare52024-01-1835'831
9 cocaman2025-05-2830'598
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-05-2814'078
13 adrian__luca2025-05-2711'891
14 James_inthe_box2025-05-289'931
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
121'540Skystars_Malware_ImphashSkystars LightDefender2025-05-28
84'764pe_imphashNone2025-05-28
78'505SharedStringsKatie Kleemola2025-04-04
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
74'505Select_from_enumerationJames_inthe_box2025-01-23
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'651IPPort_combo_memJames_inthe_box2025-03-26
59'155unixredflags3Tim Brown @timb_machine2025-05-28
59'149linux_generic_ipv6_catcher@_lubiedo2025-05-28
51'177pe_imphash2025-05-28
46'817NETmalware-lu2025-05-28
45'508Cobalt_functions@j0sm12023-08-23
41'737DebuggerCheck__APINone2025-05-28
37'038Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-05-28
31'954pdb_YARAify@wowabiy3142025-01-05

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34359494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'679c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'660b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6779fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5682ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'5641509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'557a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'772cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'490eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'453515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
23'971567156a0d6fdf21eef06d02450468e6b1c9dfb11d334b2348bccbadc2f3d8d82Executable exeCredentialFlusher Bitsight
23'932061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578PowerPoint file pptx  Jagdtiger88mm

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
144'502f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'639646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'0232eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'745884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'369afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'61787bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'27161259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'081948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
4011536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8SilentBuilder Heodo
3733072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2Gozi Heodo
3513072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+PSilentBuilder Heodo
30712288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOmlTrickBot

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'348f8f0f4c8c8c8d8f08'802 x RedLineStealer, 5'067 x Amadey, 288 x Smoke Loader
5'741b2a89c96a2cada722'283 x Formbook, 981 x Loki, 801 x AgentTesla
5'728aae2f3e38383b6291'610 x Formbook, 1'182 x CredentialFlusher, 578 x AgentTesla
4'815b298acbab2ca7a722'327 x GCleaner, 1'607 x Socks5Systemz, 67 x RedLineStealer
3'89771b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'1530000000000000000861 x AgentTesla, 458 x Formbook, 280 x RedLineStealer
2'703848c5454baf474742'086 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'0959494b494d4aeaeac754 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'070399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker