Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated.
➡️ Read here for more info

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-155'823
2 adrian__luca2025-07-14704
3 JAMESWT_WT2025-07-15231
4 aachum2025-07-15209
5 skocherhan2025-07-15179
6 SecuriteInfoCom2025-07-15178
7 burger2025-07-15130
8 threatcat_ch2025-07-15119
9 lowmal32025-07-15118
10 cocaman2025-07-1598
11 GDHJDSYDH12025-07-1375
12 smica832025-07-1564
13 Joker2025-07-1536
14 antigdi2025-07-1535
15 FXOLabs2025-07-1533

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
3'849Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-15
3'462unixredflags3Tim Brown @timb_machine2025-07-15
2'874linux_generic_ipv6_catcher@_lubiedo2025-07-15
1'243golang_bin_JCorn_CSC846Justin Cornwell2025-07-15
1'195NETmalware-lu2025-07-15
1'158DebuggerCheck__APINone2025-07-15
1'107Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-07-15
1'040ELF_MiraiNDA0E2025-07-15
957enterpriseapps2Tim Brown @timb_machine2025-07-15
889pe_imphashNone2025-07-15
889Skystars_Malware_ImphashSkystars LightDefender2025-07-15
849DetectEncryptedVariantsZinyth2025-07-15
847Sus_CMD_Powershell_UsageXiAnzheng2025-07-15
826pe_detect_tls_callbacksNone2025-07-15
822botnet_plaintext_c2cip2025-07-15

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
1'690af747282bf8a68dbd5d4b5db4fafbba61d0a418e27d62090844f36d039bef1f0Executable exe  SecuriteInfoCom
1'052872caeac3567b129ba58a84abfdd36064ecb6f3dd6538b2cc844c12431a8d106Executable exeValleyRAT GDHJDSYDH1
546964ddfec70d3a306c1a2dcae6f7da397202b08c45eabe15c0f5ad84de77393eaExecutable exeLummaStealer aachum
1406a869ebca58a769522266fa0c475bb3f60ad75527ba358b7a1d143e03d604c79Executable exeValleyRAT GDHJDSYDH1
125549caa03c9aed64e4d13cad0a9f4ef45d8729d7e777a0749df6e2b2996dbea2dExecutable exeLummaStealer aachum
122d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18Executable exeINC TheRavenFile
11206c2a137c31aae5d02b4d7df61ffd31f1af9a9e59978f15b3f7265cc751bff1fExecutable exeAkira TheRavenFile
107fd42f07848568078d4beee04bc8704b8e6178676112de9c205d054e5895882eaExecutable exeLummaStealer aachum
1069c90b3ffdffcf2db7716c2c556dc633f9dddc471748753c34449f7314a73f5cbExecutable exeValleyRAT GDHJDSYDH1
89a769c40ce48a38eed8897447081fc002d567535943befc4b51d866d134953588 apkBingoMod JAMESWT_WT
86d0552d4acdd6f0df66e3217e8fd685b69011f8ec4ffb4b57a884f97436002706 pdf  sylvestrehiguchi
85fad639fcc1401732c0de91a9e4d0950256e93a38023be935cf78c373e3e0a09b pdf  antigdi
84fc2b499708b2d20545c140906b0484546c8b3ff21341b8a5acd18f2063fa2bb5Executable exeAkira TheRavenFile
798b31874073fd9d5810247aea86d29dd37057cf23dd62c4e8c8bca5a483e65c0f apkBingoMod JAMESWT_WT
77a3c9a67b15abe9f7b6b8ecbba84f7242d2128c2f80b41d736cd95fa56b7a78c0Executable exeValleyRAT GDHJDSYDH1

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
750f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
1553d95adbf13bbe79dc24dccb401c12091AgentTesla FormBook SnakeKeylogger NanoCore
1420b768923437678ce375719e30b21693eFormbook MassLogger SnakeKeylogger AgentTesla
108bf95d1fc1d10de18b32654b123ad5e1fLummaStealer Rhadamanthys Vidar ACRStealer
48b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT EpsilonStealer AgentTesla
352eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
346e7f9a29f2c85394521a08b9f31f6275GuLoader AgentTesla RemcosRAT VIPKeylogger
31f4639a0b3116c2cfc71144b88a929cfdGuLoader Formbook VIPKeylogger Stealc
23c990338f8145dc29c6f38fb73cf05c77BlankGrabber ValleyRAT DiscordTokenStealer PythonStealer
2212e12319f1029ec4f8fcbed7e82df162DCRat RedLineStealer Formbook SnakeKeylogger

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
12812288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
12612288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
12412288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
12312288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB
12312288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
1226144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
11912288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
11912288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+
81536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5tMirai
71536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZaMirai

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
246aae2f3e38383b629125 x Formbook, 26 x SnakeKeylogger, 21 x AgentTesla
55000000000000000016 x Formbook, 11 x SnakeKeylogger, 3 x AgentTesla
229494b494d4aeaeac10 x DCRat, 2 x GCleaner, 1 x NanoCore
20306296163498f2306 x SnakeKeylogger, 2 x a310Logger, 2 x VIPKeylogger
19cdabae6fe6e7eaec7 x Amadey, 5 x AurotunStealer, 2 x njrat
18ccb66361791992cc9 x Formbook, 4 x VIPKeylogger, 2 x XWorm
1569c8c4a68e88f0c45 x SnakeKeylogger, 4 x XWorm, 4 x Formbook
14a25337335bbb1bba5 x SnakeKeylogger, 3 x Formbook, 2 x VIPKeylogger
1340b974c4d46028586 x Formbook, 3 x SnakeKeylogger, 2 x a310Logger
13399998ecd4d46c0e9 x GCleaner, 3 x SharkStealer, 1 x LummaStealer

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-15247'353
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-07-1542'648
7 SecuriteInfoCom2025-07-1539'900
8 andretavare52024-01-1835'831
9 cocaman2025-07-1531'072
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-07-1514'436
13 adrian__luca2025-07-1413'284
14 James_inthe_box2025-07-1510'047
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
125'137Skystars_Malware_ImphashSkystars LightDefender2025-07-15
88'363pe_imphashNone2025-07-15
78'515SharedStringsKatie Kleemola2025-06-30
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
74'505Select_from_enumerationJames_inthe_box2025-01-23
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'651IPPort_combo_memJames_inthe_box2025-03-26
70'869unixredflags3Tim Brown @timb_machine2025-07-15
70'263linux_generic_ipv6_catcher@_lubiedo2025-07-15
59'636Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-15
52'597NETmalware-lu2025-07-15
51'178pe_imphash2025-07-15
48'988DebuggerCheck__APINone2025-07-15
45'508Cobalt_functions@j0sm12023-08-23
31'954pdb_YARAify@wowabiy3142025-01-05

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34559494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'680c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'660b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6789fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5691509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'5692ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'558a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'775cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'490eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'453515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
24'717b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki
24'7034e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
146'656f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'643646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'3622eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'768884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'373afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'62387bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'29361259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'106948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
52612288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
41012288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
40812288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
40112288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'360f8f0f4c8c8c8d8f08'802 x RedLineStealer, 5'069 x Amadey, 288 x Smoke Loader
6'350aae2f3e38383b6291'910 x Formbook, 1'183 x CredentialFlusher, 630 x AgentTesla
5'757b2a89c96a2cada722'283 x Formbook, 981 x Loki, 803 x AgentTesla
4'837b298acbab2ca7a722'327 x GCleaner, 1'618 x Socks5Systemz, 67 x RedLineStealer
3'89971b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'2920000000000000000869 x AgentTesla, 487 x Formbook, 287 x RedLineStealer
2'704848c5454baf474742'087 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'1939494b494d4aeaeac805 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'098399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker