Statistics
MalwareBazaar produces detailed statistics on shared malware samples, including associated detections - find the available statistics below.
You can also access Spamhaus's Malware Digest report, based on MalwareBazaar data:
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the support of the volunteers who contribute malware samples. To recognise their efforts, we've created a live leaderboard on the abuse.ch Community Hub, where you can see our top contributors.
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 3'676 | SUSP_ZIP_LNK_PhishAttachment | ignacior | 2026-08-07 |
| 3'676 | SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1 | Florian Roth (Nextron Systems) | 2026-08-07 |
| 3'348 | Execution_in_LNK | @bartblaze | 2026-08-07 |
| 3'267 | SUSP_LNK_CMD | SECUINFRA Falcon Team | 2026-08-07 |
| 2'878 | Download_in_LNK | @bartblaze | 2026-08-07 |
| 2'695 | Sus_CMD_Powershell_Usage | XiAnzheng | 2026-08-10 |
| 2'240 | TH_Generic_MassHunt_Linux_Malware_2026_CYFARE | CYFARE | 2026-08-10 |
| 2'039 | MalScript_Tricks | @bartblaze | 2026-08-04 |
| 1'993 | unixredflags3 | Tim Brown @timb_machine | 2026-08-10 |
| 1'414 | CP_Script_Inject_Detector | DiegoAnalytics | 2026-08-10 |
| 1'280 | linux_generic_ipv6_catcher | @_lubiedo | 2026-08-10 |
| 1'125 | golang_bin_JCorn_CSC846 | Justin Cornwell | 2026-08-10 |
| 935 | ELF_Toriilike_persist | 4r4 | 2026-08-10 |
| 874 | VECT_Ransomware | Mustafa Bakhit | 2026-08-10 |
| 857 | DebuggerCheck__API | None | 2026-08-10 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
exe
xlsm
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
CyberFortress
Top classifications by CyberFortress for malware samples on MalwareBazaar.
ThreatZone
Top classifications by ThreatZone for malware samples on MalwareBazaar.
Top File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 4 | 6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9 | ConnectWise |
| 3 | 6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9 | ConnectWise |
| 3 | 98304:JzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:JhfefPtHxcp9ym3nltDUJV | ConnectWise |
| 2 | 12288:Oijanr2ZYGCCa0IjQ3M86MzJnlWEmdpgRK3vFo/qZmr68N8pqP8qOt:Oik6CCAsMTMFnlWLdGw/fmr1bq | Mirai |
| 2 | 98304:yzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:yhfefPtHxcp9ym3nltDUJV | ConnectWise |
| 2 | 3072:sy5ZnbqEfLe1rUVu3ciNxQ3Uh0sAz4EBDvusrCRJ5GVQjQSltq7r1DGSy+iP5/dX:WQ3zJz4EtuKk4SzgqVVxHwRU | RemusStealer |
| 2 | 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMz:9XhICteErownP0oTcMsABqlDQky | |
| 2 | 98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV | ConnectWise |
| 2 | 768:J8vCB+25j6es8RH9FYpMSUpi+20qUpi+20YQX:J8l25Jhd2QX | |
| 2 | 98304:fzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:fhfefPtHxcp9ym3nltDUJV | ConnectWise |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 182 | c6c2ccc4f4e0e0f8 | 32 x Adware.Yogi, 1 x ValleyRAT, 1 x SVCStealer |
| 48 | 3e73715d4d5d7d23 | 48 x Formbook |
| 23 | 0000000000000000 | 10 x Formbook, 4 x AgentTesla, 2 x RemcosRAT |
| 16 | e0e2aba3a5b8b8a8 | 8 x AsyncRAT, 4 x Formbook, 2 x AgentTesla |
| 11 | c4d48eaa8ad4d4f8 | 11 x RemcosRAT |
| 9 | 5050d270cccc82ae | 3 x ValleyRAT, 3 x ConnectWise |
| 9 | d4c4c4d8ccd4f0cc | 4 x DarkCloud, 1 x AgentTesla, 1 x RemcosRAT |
| 9 | e09a981c04820182 | 4 x AgentTesla, 3 x Formbook, 1 x AsyncRAT |
| 8 | 1003873d31213f10 | 8 x a310Logger |
| 8 | 44302c2c70703002 | 4 x Formbook, 2 x GCleaner, 1 x PureLogsStealer |
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the support of the volunteers who contribute malware samples. To recognise their efforts, we've created a live leaderboard on the abuse.ch Community Hub, where you can see our top contributors.
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 141'837 | Skystars_Malware_Imphash | Skystars LightDefender | 2026-08-10 |
| 117'115 | unixredflags3 | Tim Brown @timb_machine | 2026-08-10 |
| 105'062 | pe_imphash | None | 2026-08-10 |
| 102'700 | linux_generic_ipv6_catcher | @_lubiedo | 2026-08-10 |
| 78'535 | SharedStrings | Katie Kleemola | 2026-07-05 |
| 76'741 | DebuggerCheck__API | None | 2026-08-10 |
| 76'712 | Email_stealer_bin_mem | James_inthe_box | 2024-06-13 |
| 75'030 | NET | malware-lu | 2026-08-10 |
| 74'506 | Select_from_enumeration | James_inthe_box | 2025-07-30 |
| 73'333 | UAC_bypass_bin_mem | James_inthe_box | 2023-03-07 |
| 72'679 | Sus_Obf_Enc_Spoof_Hide_PE | XiAnzheng | 2026-07-15 |
| 71'652 | IPPort_combo_mem | James_inthe_box | 2025-12-01 |
| 51'184 | pe_imphash | 2026-08-10 | |
| 49'970 | golang_bin_JCorn_CSC846 | Justin Cornwell | 2026-08-10 |
| 45'508 | Cobalt_functions | @j0sm1 | 2023-08-23 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
pptx
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
CyberFortress
Top classifications by CyberFortress for malware samples on MalwareBazaar.
ThreatZone
Top classifications by ThreatZone for malware samples on MalwareBazaar.
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.
doc
htaTop File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 1'124 | 12288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4 | Quakbot |
| 1'123 | 12288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4 | Quakbot |
| 1'121 | 12288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4 | Quakbot |
| 528 | 1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz | SilentBuilder Heodo |
| 526 | 12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR | Mirai |
| 419 | 1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz | SilentBuilder Heodo |
| 416 | 768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6 | SilentBuilder Heodo |
| 410 | 12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc | |
| 408 | 12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa | Gafgyt |
| 407 | 768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8 | Mirai |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 15'468 | f8f0f4c8c8c8d8f0 | 8'803 x RedLineStealer, 5'108 x Amadey, 288 x Smoke Loader |
| 8'154 | aae2f3e38383b629 | 2'698 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla |
| 5'954 | b2a89c96a2cada72 | 2'283 x Formbook, 981 x Loki, 803 x AgentTesla |
| 5'197 | b298acbab2ca7a72 | 2'335 x GCleaner, 1'826 x Socks5Systemz, 67 x RedLineStealer |
| 3'914 | 71b119dcce576333 | 3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT |
| 3'846 | 0000000000000000 | 907 x AgentTesla, 569 x Formbook, 316 x RedLineStealer |
| 3'169 | 848c5454baf47474 | 2'466 x Adware.Neoreklami, 102 x RedLineStealer, 65 x N-able |
| 3'016 | 9494b494d4aeaeac | 907 x DCRat, 486 x NirCmd, 172 x RedLineStealer |
| 1'411 | 399998ecd4d46c0e | 573 x Quakbot, 312 x GCleaner, 137 x ArkeiStealer |
| 1'192 | c4d48eaa8ad4d4f8 | 1'187 x RemcosRAT, 1 x Worm.Ramnit, 1 x Vjw0rm |
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.