Authenticate for API access | If you are experiencing issues with receiving data from abuse.ch platforms via API, please ensure your requests are authenticated.
➡️ Read here for more info

Statistics

MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.

You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-195'680
2 adrian__luca2025-07-14690
3 JAMESWT_WT2025-07-18319
4 aachum2025-07-18217
5 skocherhan2025-07-17207
6 SecuriteInfoCom2025-07-18178
7 burger2025-07-18175
8 lowmal32025-07-18106
9 threatcat_ch2025-07-1797
10 cocaman2025-07-1891
11 GDHJDSYDH12025-07-1868
12 smica832025-07-1861
13 antigdi2025-07-1840
14 Joker2025-07-1536
15 FXOLabs2025-07-1830

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
3'622Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-18
3'301unixredflags3Tim Brown @timb_machine2025-07-19
2'619linux_generic_ipv6_catcher@_lubiedo2025-07-18
1'269golang_bin_JCorn_CSC846Justin Cornwell2025-07-18
1'217DebuggerCheck__APINone2025-07-18
1'200NETmalware-lu2025-07-18
1'132Linux_Trojan_Gafgyt_28a2fe0cElastic Security2025-07-18
1'083ELF_MiraiNDA0E2025-07-19
959botnet_plaintext_c2cip2025-07-18
908DetectEncryptedVariantsZinyth2025-07-18
907Sus_CMD_Powershell_UsageXiAnzheng2025-07-18
874pe_imphashNone2025-07-18
873Skystars_Malware_ImphashSkystars LightDefender2025-07-18
819enterpriseapps2Tim Brown @timb_machine2025-07-18
818pe_detect_tls_callbacksNone2025-07-18

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
1'690af747282bf8a68dbd5d4b5db4fafbba61d0a418e27d62090844f36d039bef1f0Executable exe  SecuriteInfoCom
547964ddfec70d3a306c1a2dcae6f7da397202b08c45eabe15c0f5ad84de77393eaExecutable exeLummaStealer aachum
490d852c57134c0a34471df5059def176877463ff41c242e9ec25a4e191ba841613Executable exeLummaStealer aachum
46130b64311ed4920ec78dc850bda4cdf08cee2922d4a1ef798d30799d974a9196fExecutable exeLummaStealer aachum
43308d1bd15aa93c61a881b5fe78a58a36a1550299d166644b616ee05dc68161b88Executable exe  aachum
1476a869ebca58a769522266fa0c475bb3f60ad75527ba358b7a1d143e03d604c79Executable exeValleyRAT GDHJDSYDH1
137d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18Executable exeINC TheRavenFile
13106c2a137c31aae5d02b4d7df61ffd31f1af9a9e59978f15b3f7265cc751bff1fExecutable exeAkira TheRavenFile
126549caa03c9aed64e4d13cad0a9f4ef45d8729d7e777a0749df6e2b2996dbea2dExecutable exeLummaStealer aachum
113fd42f07848568078d4beee04bc8704b8e6178676112de9c205d054e5895882eaExecutable exeLummaStealer aachum
1129c90b3ffdffcf2db7716c2c556dc633f9dddc471748753c34449f7314a73f5cbExecutable exeValleyRAT GDHJDSYDH1
8947aab1f5a9de4659066c5d1ca8f3a72858811c3d41b6de5f04439e96d134d6d7Executable exe  aachum
88fad639fcc1401732c0de91a9e4d0950256e93a38023be935cf78c373e3e0a09b pdf  antigdi
79a3c9a67b15abe9f7b6b8ecbba84f7242d2128c2f80b41d736cd95fa56b7a78c0Executable exeValleyRAT GDHJDSYDH1
790aa6b1506747726828f751c3c937d1eeb69aeee92c343d4bbc117ff3bc9300d1 html  JAMESWT_WT

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
716f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
1893d95adbf13bbe79dc24dccb401c12091AgentTesla FormBook SnakeKeylogger NanoCore
111bf95d1fc1d10de18b32654b123ad5e1fLummaStealer Rhadamanthys Vidar ACRStealer
1040b768923437678ce375719e30b21693eFormbook MassLogger SnakeKeylogger AgentTesla
40b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT EpsilonStealer AgentTesla
366e7f9a29f2c85394521a08b9f31f6275GuLoader AgentTesla RemcosRAT VIPKeylogger
28c990338f8145dc29c6f38fb73cf05c77BlankGrabber ValleyRAT DiscordTokenStealer PythonStealer
24f4639a0b3116c2cfc71144b88a929cfdGuLoader Formbook VIPKeylogger Stealc
2312e12319f1029ec4f8fcbed7e82df162DCRat RedLineStealer Formbook SnakeKeylogger
20a7c4b62062a898c7859aeb5101fe98e5LummaStealer Stealc CoinMiner njrat

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
9512288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
9412288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
9412288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG
9312288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
9212288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB
916144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP
9012288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
8912288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+
81536:nEbNn3E5sOq19Pj21ZXBbpuW+8nkSXeVSvhWy5UzS:+n3IxdpNkSXsKf5tMirai
71536:q9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:CEkiUZJNZHKMNU6ba4XwtsluUsPMkMirai

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
233aae2f3e38383b629119 x Formbook, 30 x SnakeKeylogger, 26 x AgentTesla
46000000000000000015 x Formbook, 8 x SnakeKeylogger, 3 x AgentTesla
229494b494d4aeaeac10 x DCRat, 3 x DeerStealer, 2 x GCleaner
21cdabae6fe6e7eaec7 x Amadey, 7 x AurotunStealer, 2 x PureLogsStealer
20306296163498f2306 x SnakeKeylogger, 2 x a310Logger, 2 x VIPKeylogger
20ccb66361791992cc10 x Formbook, 5 x VIPKeylogger, 2 x XWorm
1340b974c4d46028586 x Formbook, 3 x SnakeKeylogger, 2 x a310Logger
12f0e8ccb2d4d4f0f07 x Formbook, 2 x RemcosRAT, 1 x MassLogger
12c6c2ccc4f4e0e0f82 x DiamotrixClipper, 1 x ValleyRAT
12a808f89e88e022107 x VIPKeylogger, 5 x GuLoader

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2025-07-19248'270
2 zbetcheckin2024-11-0978'688
3 lazyactivist1922024-01-1769'729
4 Cryptolaemus12024-03-2067'837
5 seifreed2021-10-1948'947
6 JAMESWT_WT2025-07-1842'761
7 SecuriteInfoCom2025-07-1839'951
8 andretavare52024-01-1835'831
9 cocaman2025-07-1831'099
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2024-10-1815'559
12 lowmal32025-07-1814'450
13 adrian__luca2025-07-1413'284
14 James_inthe_box2025-07-1810'059
15 Bitsight2025-04-029'779

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
125'280Skystars_Malware_ImphashSkystars LightDefender2025-07-18
88'506pe_imphashNone2025-07-18
78'515SharedStringsKatie Kleemola2025-06-30
76'712Email_stealer_bin_memJames_inthe_box2024-06-13
74'505Select_from_enumerationJames_inthe_box2025-01-23
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'651IPPort_combo_memJames_inthe_box2025-03-26
71'271unixredflags3Tim Brown @timb_machine2025-07-19
70'518linux_generic_ipv6_catcher@_lubiedo2025-07-18
60'138Sus_Obf_Enc_Spoof_Hide_PEXiAnzheng2025-07-18
52'783NETmalware-lu2025-07-18
51'178pe_imphash2025-07-18
49'253DebuggerCheck__APINone2025-07-18
45'508Cobalt_functions@j0sm12023-08-23
31'954pdb_YARAify@wowabiy3142025-01-05

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'09370ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'968c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'34559494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
40'680c24ff50a15372a69690f4c7cd783609e92924ec38f2f42148573d35980f07cd3Executable exeLummaStealer abuse_ch
40'660b828382168a0077c7d5cd8faf44d5da19a4d852cfca7c85dae63de97e5dd6753Executable exeLummaStealer abuse_ch
32'6789fd06d80534b729cca8ad2affa0be6b3108c6a117e7b20f81470b2c01335453b elfMirai abuse_ch
32'5691509cb4a59087be095de34a01f19e292933a3133bc63de252555d0188d0710bd elf  abuse_ch
32'5692ee2eaa1fce89b91fb70dd2e853ac63b600c11feae4a1624fa90f1c6e33bc67c elfMirai abuse_ch
32'558a0f145290eaa8b3b74d83702f391952617262388779aa607dbaac524b4567266 elfMirai abuse_ch
32'543216ab12c56bba575bd40aaa5d602c062abb5fc8ac405f27a43619c3370d11707 elf  abuse_ch
30'776cdff50f4126445f55098d307fa40396a80396cc50d4d94c0c8a849b4de2b7da2Executable exeLummaStealer abuse_ch
30'490eb097b81a3a0a5510aec27b28fd7a140152eb217520fca3dd92f27a72d817045 elfMirai abuse_ch
30'453515eb18d3f105eb377e73dfa2ee34a24f50da54f0600d02d7914d41c916f3848 elfMirai abuse_ch
24'717b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki
24'7034e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

CyberFortress CyberFortress


Top classifications by CyberFortress for malware samples on MalwareBazaar.

ThreatZone ThreatZone


Top classifications by ThreatZone for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
146'761f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger RedLineStealer
14'644646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
8'3632eabe9054cad5152567f0699947a2c5bLummaStealer Stealc Healer Amadey
7'768884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
4'375afcdf79be1557326c854b6e20cb900a7FormBook AgentTesla RemcosRAT RedLineStealer
3'62387bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID Blackmoon TrickBot
3'29361259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
3'107948cc502fe9226992dce9417f952fce3CredentialFlusher Formbook AgentTesla RedLineStealer

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
52612288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtRMirai
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
41012288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc
40812288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXaGafgyt
40112288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'361f8f0f4c8c8c8d8f08'802 x RedLineStealer, 5'069 x Amadey, 288 x Smoke Loader
6'376aae2f3e38383b6291'917 x Formbook, 1'183 x CredentialFlusher, 636 x AgentTesla
5'757b2a89c96a2cada722'283 x Formbook, 981 x Loki, 803 x AgentTesla
4'837b298acbab2ca7a722'327 x GCleaner, 1'618 x Socks5Systemz, 67 x RedLineStealer
3'89971b119dcce5763333'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT
3'2960000000000000000869 x AgentTesla, 488 x Formbook, 287 x RedLineStealer
2'704848c5454baf474742'087 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox
2'1979494b494d4aeaeac807 x DCRat, 172 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'099399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker