Statistics

MalwareBazaar produces various statistics on malware samples shared, including their detections. The available statistics can be found below.

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2023-11-30672
2 andretavare52023-11-29593
3 zbetcheckin2023-11-30355
4 SecuriteInfoCom2023-11-29331
5 JAMESWT_MHT2023-11-29236
6 cocaman2023-11-29221
7 lowmal32023-11-29193
8 elfdigest2023-11-29113
9 NIXLovesCooper2023-11-2984
10 smica832023-11-2974
11 adrian__luca2023-11-2766
12 fabiodemartin2023-11-2959
13 James_inthe_box2023-11-2953
14 pmelson2023-11-2947
15 malwarelabnet2023-11-2945

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
794NETmalware-lu2023-11-30
763Skystars_Malware_ImphashSkystars LightDefender2023-11-29
763pe_imphashNone2023-11-29
684DebuggerCheck__APINone2023-11-30
526maldoc_find_kernel32_base_method_1Didier Stevens (https://DidierStevens.com)2023-11-30
477NETexecutableMicrosoftmalware-lu2023-11-29
365MD5_Constantsphoul (@phoul)2023-11-30
262pe_no_import_tableNone2023-11-29
257DebuggerCheck__QueryInfoNone2023-11-30
229INDICATOR_SUSPICIOUS_Binary_References_BrowsersditekSHen2023-11-30
223maldoc_getEIP_method_1Didier Stevens (https://DidierStevens.com)2023-11-29
215shellcodenex2023-11-29
199RIPEMD160_Constantsphoul (@phoul)2023-11-30
199SHA1_Constantsphoul (@phoul)2023-11-30
198meth_get_eipWilli Ballenthin2023-11-29

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
968c72d36a48701f9275db84dc7d0acae82304e6062ee48108e5507be32673133b6Excel file xlsxAgentTesla abuse_ch
942c38075212f7565441edf9d67d0edcd35158da4ffb87719900ef1e47ccb199482Excel file xlsx  maikxchd
931022f8eb1dc8f85df1969b369707c4307a4e15ec0a33a0cb36c9611cb6d2fb133Excel file xlsxAgentTesla abuse_ch
9273bff4f95cc537a4ad075931d288e21a0640a1764a29a40f0b3ea0d89f54635a9Word file docAgentTesla malwarelabnet
92088a7d32830a0a2e9a971fd47daacbe9f1c6fe85e5062c92adb6899cdb420103bExcel file xlsx  lowmal3
9178cc1e052f26f92a3dbf9f39472ff1480165af4cc97f691512337cea470434b8eExcel file xlsxAgentTesla abuse_ch
912f94d94bd9114e1bc05024224f8253949f599335cc112c4b0652f2a7f4d5366beExcel file xlsxAgentTesla abuse_ch
9090a79d9a09643f301e8dbed261607546dff926210a9ba4efef99506cb6a76982cExcel file xlsx  abuse_ch
90662e9d7296de6b25e0c67785d5c39557dfa1fb099b5f1fab24dfa1bcdcd78989aWord file docRemcosRAT lowmal3
901f12a9220246114b76d86519b74bfb90ae0974f8479457f318914128ce3df4290Excel file xlsx  cocaman
873add081b89a77bac44ed5454a50e61ba7a858b86570e0654b3bf68a75e3dd3cc6Excel file xlsxAveMariaRAT lowmal3
846f4cf566217708d9c5e6d7bb3c39fa2acb5ae2ee86fd0fed9d19999f4b7b22eabExcel file xlsm  NLLOFF
841df6f30d1f50ef7c387700d1d8dd368c242634aca9a8beda2c0e95f5e7c2f9f37Excel file xlsxAgentTesla lowmal3
822a8407bd083e065222443737a0197f070b8ba1d30a7ef25e99ae3e0ef4af351b3Excel file xlsxAgentTesla malwarelabnet
818adc77c376bb24286de600515aae37a4d4e1136c9c349ee6c36531e397522258eWord file docNanoCore NIXLovesCooper

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

CAPE Sandbox CAPE Sandbox


Top detections by CAPE Sandbox for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
812f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger Loki
144646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
78078471ac5a76189ffe465abe0c89c6b7RiseProStealer
757482a1595744a3c77ac9461f3f27a729RiseProStealer
50b76363e9cb88bf9390860da8e50999d2Formbook AgentTesla SnakeKeylogger Loki
38884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RedLineStealer Socelars
333786a4cf8bfee8b4821db03449141df4Adware.Neoreklami RedLineStealer
264328f7206db519cd4e82283211d98e83RedLineStealer Arechclient2 DCRat CoinMiner
20b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT AgentTesla Formbook
1924cdc56b5fda73aeb4bb75aa4a21ffc3RemcosRAT

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
6124576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WNI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTyRiseProStealer
5524576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6RiseProStealer
1924576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJtrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TVrK5Zln2i6RiseProStealer
11768:f8FhylJE+hwr5hN7F0I0bQyvUgq65DQVi:f8qlJEQwrDNuIyvD5sVRedLineStealer LummaStealer
1024576:2opGDjnvrPpkjos0OtjcFc5kM49dj+IuxWQOIjuJuVvhbqL0HtFcgekRP9dT0WtI:OnvrPGT0Egyudc4tI3bqL0NFchaP9dTSRiseProStealer
724576:8N+bPGUvbX8AdjI9Bahe/wz78RaiyhrbnC3OlKekN4srzEhbaLUCKWmRlsSmYTzC:8wyYjI9EheW7WaiUy3V6baLUCmRlnmYqRiseProStealer
31536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7JMirai
349152:O2YwvLbBL8IQbDbq6hhFiucmUHq2uK3njQJJmgBkVrAhUQCe4f4/fzdedvQRY0E:XfvXBLk42UHuK3jWXWKOe4fWdmQlESocks5Systemz
298304:Ad3L0TpNwgdnac+LdvXVajAqlxgc92ca6Qc3zQxHI7Fya0pYrAKlE:M3Lq6gdna/raEqwzca6QcjDopKuSocks5Systemz
249152:UX2JWJuWy4rOP78N2xTS/Q6TNMAeGG+wqkDdWcuZC9baVhLKIyOnxLy5/INYO:8AqA4bNMAeLVdWRC9bO2IyOnhJYOLummaStealer

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
146f8f0f4c8c8c8d8f067 x RiseProStealer, 44 x RedLineStealer, 28 x LummaStealer
49b298acbab2ca7a7234 x Socks5Systemz, 2 x Arechclient2, 1 x RustyStealer
37b2a89c96a2cada7212 x GuLoader, 9 x RemcosRAT, 8 x Formbook
34848c5454baf4747433 x Adware.Neoreklami
2368c4d2d2725a525210 x Formbook, 8 x AgentTesla, 2 x SnakeKeylogger
2215cce4f4d0d8cc5312 x Formbook, 5 x AgentTesla, 3 x RemcosRAT
2000000000000000009 x AgentTesla, 2 x RedLineStealer, 2 x AsyncRAT
2020c89c88e63c4c1210 x AgentTesla, 7 x Formbook, 1 x Loki
17c4c6dcccecf8b4b812 x AgentTesla, 3 x Formbook, 2 x RemcosRAT
16c4d48eaa8ad4d4f816 x RemcosRAT

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2023-11-30158'536
2 lazyactivist1922022-05-1869'727
3 Cryptolaemus12023-11-0667'825
4 zbetcheckin2023-11-3062'948
5 Seifreed2021-10-1948'947
6 andretavare52023-11-2934'516
7 JAMESWT_MHT2023-04-2926'183
8 SecuriteInfoCom2023-11-2925'999
9 cocaman2023-11-2922'912
10 Libranalysis2023-04-1717'030
11 GovCERT_CH2022-11-1415'557
12 lowmal32023-11-2910'235
13 James_inthe_box2023-11-298'589
14 tolisec2022-07-196'610
15 OSimao2022-08-315'845

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
87'720Skystars_Malware_ImphashSkystars LightDefender2023-11-29
78'473SharedStringsKatie Kleemola2023-11-03
76'708Email_stealer_bin_memJames_inthe_box2023-05-13
74'501Select_from_enumerationJames_inthe_box2022-12-29
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'647IPPort_combo_memJames_inthe_box2023-08-23
51'156pe_imphash2023-11-29
50'555pe_imphashNone2023-11-29
45'508Cobalt_functions@j0sm12023-08-23
29'569MALWARE_Win_DLLLoaderditekSHen2022-09-07
28'707pdb_YARAify@wowabiy3142023-09-07
28'421DridexV4kevoreilly2022-09-07
28'072ach_Dridex_xls_20200528abuse.ch2022-05-06
25'459Win32_Trojan_EmotetReversingLabs2023-10-11
25'044DridexLoaderkevoreilly2022-09-07

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'08070ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'957c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'31159494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
22'8322ae29fff50afc21422c12b4e64b055df4d342fb493a667e18b6dda7ad3403857Executable exeSmoke Loader andretavare5
18'328b0413e037f2efd5eff7a1b80f339dc661bbdd8e36ef176becc12815f78577fabExecutable exeSliver pr0xylife
17'757430dbb439bf85fd2a8846a43c0b0615305ef25ac8b9496d272c2dbefd3158ed2Executable exeSnakeKeylogger abuse_ch
16'1682190623b860d6783e4c6758c057ceecb9023c3b89b824cacc74e6a9c84ed99c1Executable exeRedLineStealer abuse_ch
9'054378ddb826b406a8bdcd2358760d93822f83250ed8709ab33aa951042c85c9882Executable exeLummaStealer abuse_ch
7'889094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78dExecutable exeAgentTesla abuse_ch
7'791061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578PowerPoint file pptx  Jagdtiger88mm
7'77092779228416f0dce42fd4e3d1ead5cfaecf563694391c01f421c53edd773b72ePowerPoint file pptx  cocaman
7'7124dd75e9c997abbb78aff675a28039b49ed7ebbfc2d97a4e378f7fd0d03d7e2fdPowerPoint file pptx  cocaman
7'6625206fb8a22102a8cda01faed36f0b860d191df697ee327ddb6855c8821e00af3PowerPoint file pptx  cocaman
7'6347e6aaa62831f2c2d26fbd3af7a7650fced824eb60c8dcbb85bb61c25a9614674PowerPoint file pptx  EldadViola
7'628b206ac5443480cdf5dfec41a5ff725efa5aa550251c908f1309f848d0ce57600PowerPoint file pptx Twitter Anonymous

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

CAPE Sandbox CAPE Sandbox


Top detections by CAPE Sandbox for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
119'037f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger Loki
14'166646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
3'961884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RedLineStealer Socelars
3'32287bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID TrickBot Netsky
3'13561259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
2'180433637d5d88b1ab11a7e5bfc30abfe93Dridex
2'1203786a4cf8bfee8b4821db03449141df4Adware.Neoreklami RedLineStealer
1'9797fa974366048f9c551ef45714595665eFormbook Loki AgentTesla SnakeKeylogger

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
4011536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8SilentBuilder Heodo
3733072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2Gozi Heodo
3513072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+PSilentBuilder Heodo
30712288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOmlTrickBot

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
14'703f8f0f4c8c8c8d8f08'674 x RedLineStealer, 5'014 x Amadey, 274 x Smoke Loader
5'350b2a89c96a2cada722'239 x Formbook, 981 x Loki, 772 x AgentTesla
3'84271b119dcce5763333'557 x Heodo, 202 x TrickBot, 13 x Gh0stRAT
2'863b298acbab2ca7a722'327 x GCleaner, 66 x RedLineStealer, 66 x RecordBreaker
2'436848c5454baf474741'886 x Adware.Neoreklami, 99 x RedLineStealer, 33 x DiamondFox
1'9750000000000000000596 x AgentTesla, 237 x Formbook, 200 x SnakeKeylogger
1'1859494b494d4aeaeac283 x DCRat, 160 x RedLineStealer, 134 x CryptOne
1'008399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker
81179756cecb29999b9731 x Heodo, 20 x Nitol, 20 x ManusCrypt
688480c1c4c4f594b14172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey