Statistics
MalwareBazaar produces various statistics on malware samples shared, including their detections. The available statistics can be found below.
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.
| Rank | Reporter | Last activity | Submissions |
|---|---|---|---|
| 1 |  @abuse_ch | 2022-06-26 | 1'289 |
| 2 |  @zbetcheckin | 2022-06-26 | 1'035 |
| 3 |  @KdssSupport | 2022-06-24 | 535 |
| 4 |  @SecuriteInfoCom | 2022-06-25 | 448 |
| 5 |  @GovCERT_CH | 2022-06-26 | 395 |
| 6 |  @tolisec | 2022-06-26 | 238 |
| 7 |  @JAMESWT_MHT | 2022-06-26 | 214 |
| 8 |  @cocaman | 2022-06-24 | 211 |
| 9 |  @pr0xylife | 2022-06-24 | 155 |
| 10 |  @TeamDreier | 2022-06-21 | 139 |
| 11 |  @obfusor | 2022-06-26 | 137 |
| 12 |  @malwarelabnet | 2022-06-24 | 112 |
| 13 |  @lowmal3 | 2022-06-24 | 108 |
| 14 |  @James_inthe_box | 2022-06-24 | 70 |
| 15 |  @adrian__luca | 2022-06-22 | 46 |
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 2'231 | exploit_any_poppopret | Jeff White [karttoon@gmail.com] @noottrak | 2022-06-24 |
| 1'857 | pe_imphash | 2022-06-26 | |
| 1'857 | Skystars_Malware_Imphash | Skystars LightDefender | 2022-06-26 |
| 490 | pdb_YARAify | @wowabiy314 | 2022-06-26 |
| 489 | win_heodo | 2022-06-26 | |
| 416 | crime_win64_emotet_unpacked | Rony (r0ny_123) | 2022-06-26 |
| 387 | Emotet_Botnet | Harish Kumar P | 2022-06-26 |
| 370 | cobalt_strike_tmp01925d3f | The DFIR Report | 2022-06-26 |
| 358 | meth_get_eip | Willi Ballenthin | 2022-06-26 |
| 337 | myMirai | 2022-06-26 | |
| 260 | unixredflags3 | Tim Brown @timb_machine | 2022-06-26 |
| 220 | MALWARE_Win_AgentTeslaV3 | ditekSHen | 2022-06-25 |
| 217 | linux_generic_ipv6_catcher | @_lubiedo | 2022-06-26 |
| 203 | MAL_Lokibot_Stealer | 2022-06-26 | |
| 190 | INDICATOR_SUSPICIOUS_Binary_References_Browsers | ditekSHen | 2022-06-26 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
msi
dll
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
CAPE Sandbox
Top detections by CAPE Sandbox for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
Top File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 7 | 1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5oV/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgv | SilentBuilder Heodo |
| 6 | 12288:SHqj6HEjkcF8GrjVrV34sxjX4VzIimwAV24yO+4XN:k2FkceG9rVl5XPimeHK9 | AveMariaRAT RemcosRAT DBatLoader FormBook |
| 5 | 1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgG7HuS4VcTO9/r7UYdEJeZ:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/dc | Heodo SilentBuilder |
| 5 | 12288:VdMRkCvvbYZbq/7a2fpqDF5o2t9uBSFBuBCjSUudUkqLt33xQFnGWeOkD:VmKoyq/O2ByFPt9uIiT9dUkq9aF | Formbook RemcosRAT ModiLoader AveMariaRAT |
| 5 | 1536:ROOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgG7HuS4VcTO9/r7UYdEJeZ:RBKpb8rGYrMPe3q7Q0XV5xtezEsi8/d8 | SilentBuilder Heodo |
| 5 | 12288:QOVndiHQ0jin7Oh0Lpm1oobShFlp/iCYGCBYAyEx:dVmiyh0Loo3PZiDz | Heodo |
| 5 | 1536:dpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9HuS4VcTO9/r7UYdEJe5oN/:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgH | SilentBuilder Heodo |
| 5 | 24576:mArq7iX2O7Zo+r5E1kBiKvyJsPFtZd52EUAEc:m17+7rTPdtZ9Ec | Formbook AveMariaRAT |
| 4 | 12288:QOVndiHQ0jin7Oh0Lpm1UobShFlp/iCYGCBYAyEx:dVmiyh0LoU3PZiDz | Heodo |
| 4 | 1536:VTOKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgTKHuS4NcTO9/z7UYdEJBc:VaKpb8rGYrMPe3q7Q0XV5xtezEsi8/dE | SilentBuilder Heodo |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 53 | 0000000000000000 | 15 x Formbook, 11 x AgentTesla, 10 x Loki |
| 45 | 399998ecd4d46c0e | 43 x Quakbot, 1 x DBatLoader, 1 x CryptOne |
| 38 | d4aae8cce8b296cc | 16 x AgentTesla, 10 x Loki, 7 x FormBook |
| 37 | 818da080a0a0a0a2 | 37 x Heodo |
| 37 | 0022a3a2b8a6e610 | 16 x Formbook, 7 x AgentTesla, 6 x Loki |
| 31 | b28ccaacda53d39b | 26 x Formbook |
| 29 | 3a9a18b2a484a0c4 | 29 x Heodo |
| 29 | 02616868e0e4e800 | 8 x Formbook, 7 x Loki, 4 x AgentTesla |
| 27 | b2a89c96a2cada72 | 11 x Formbook, 10 x GuLoader, 3 x NanoCore |
| 23 | ecbcece2f2d0f4f9 | 23 x GuLoader |
Malware sample shared
The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.
Top Reporters
It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.
| Rank | Reporter | Last activity | Submissions |
|---|---|---|---|
| 1 | @abuse_ch | 2022-06-26 | 106'817 |
| 2 |  @lazyactivist192 | 2022-05-18 | 69'727 |
| 3 |  @Cryptolaemus1 | 2022-05-04 | 67'812 |
| 4 |  @Seifreed | 2021-10-19 | 48'947 |
| 5 | @zbetcheckin | 2022-06-26 | 35'391 |
| 6 | @JAMESWT_MHT | 2022-06-26 | 22'954 |
| 7 |  @Libranalysis | 2022-03-29 | 17'029 |
| 8 | @cocaman | 2022-06-24 | 14'848 |
| 9 | @SecuriteInfoCom | 2022-06-25 | 13'788 |
| 10 | @GovCERT_CH | 2022-06-26 | 13'105 |
| 11 | @James_inthe_box | 2022-06-24 | 6'227 |
| 12 |  @FORMALITYDE | 2022-06-21 | 5'664 |
| 13 | @tolisec | 2022-06-26 | 5'597 |
| 14 |  @jarumlus | 2021-09-28 | 5'360 |
| 15 | @lowmal3 | 2022-06-24 | 5'265 |
Top Malware Families
Top Tags
Most matching YARA rules
YARA rules that matched most on malware samples in MalwareBazaar.
| Malware Samples | YARA rule | Author | Last match |
|---|---|---|---|
| 78'468 | SharedStrings | Katie Kleemola | 2021-12-26 |
| 76'696 | Email_stealer_bin_mem | James_inthe_box | 2022-05-16 |
| 74'496 | Select_from_enumeration | James_inthe_box | 2021-12-26 |
| 73'329 | UAC_bypass_bin_mem | James_inthe_box | 2022-04-20 |
| 71'638 | IPPort_combo_mem | James_inthe_box | 2022-05-19 |
| 45'498 | Cobalt_functions | @j0sm1 | 2022-05-19 |
| 41'832 | Skystars_Malware_Imphash | Skystars LightDefender | 2022-06-26 |
| 34'409 | pe_imphash | 2022-06-26 | |
| 29'565 | MALWARE_Win_DLLLoader | ditekSHen | 2022-04-09 |
| 28'410 | DridexV4 | kevoreilly | 2022-04-09 |
| 28'072 | ach_Dridex_xls_20200528 | abuse.ch | 2022-05-06 |
| 25'452 | Win32_Trojan_Emotet | ReversingLabs | 2022-03-29 |
| 25'036 | DridexLoader | kevoreilly | 2022-04-09 |
| 23'584 | win_dridex_auto | Felix Bilstein | 2022-04-09 |
| 23'180 | SUSP_Excel4Macro_AutoOpen | John Lambert @JohnLaTwC | 2022-06-24 |
Most downloaded Malware Samples
Most downloaded malware samples on MalwareBazaar.
ANY.RUN
Top detections by ANY.RUN for malware samples on MalwareBazaar.
CAPE Sandbox
Top detections by CAPE Sandbox for malware samples on MalwareBazaar.
ClamAV
Top detections by ClamAV for malware samples on MalwareBazaar.
Intezer
Top detections by Intezer for malware samples on MalwareBazaar.
Joe Sandbox
Top detections by Joe Sandbox for malware samples on MalwareBazaar.
CERT.PL MWDB
Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.
ReversingLabs
Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.
Threatray
Top detections by Threatray for malware samples on MalwareBazaar.
Triage
Top detections by Triage for malware samples on MalwareBazaar.
UnpacMe
Top detections by UnpacMe for malware samples on MalwareBazaar.
VMRay
Top detections by VMRay for malware samples on MalwareBazaar.
FileScan.IO
Top classifications by FileScan.IO for malware samples on MalwareBazaar.
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.
xls
exe
doc
htaTop File Types
Most seen file types associated with malware samples on MalwareBazaar.
Top imphashes
Most seen imphashes on MalwareBazaar.
Top ssdeep hashes
Most seen ssdeep hashes on MalwareBazaar.
| Malware Sample | ssdeep | Signature(s) |
|---|---|---|
| 1'124 | 12288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4 | Quakbot |
| 1'123 | 12288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4 | Quakbot |
| 1'121 | 12288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4 | Quakbot |
| 528 | 1536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkz | SilentBuilder Heodo |
| 419 | 1536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxz | SilentBuilder Heodo |
| 416 | 768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6 | SilentBuilder Heodo |
| 401 | 1536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8 | SilentBuilder Heodo |
| 373 | 3072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2 | Gozi Heodo |
| 351 | 3072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+P | SilentBuilder Heodo |
| 307 | 12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml | TrickBot |
Top dhash icon
Most seen dhashes of icons from PE32 executables and their signatures.
| Malware Sample | dhash icon | Signature(s) |
|---|---|---|
| 3'627 | 71b119dcce576333 | 3'382 x Heodo, 200 x TrickBot, 9 x BazaLoader |
| 2'950 | b2a89c96a2cada72 | 1'313 x Formbook, 779 x Loki, 256 x AgentTesla |
| 771 | 79756cecb29999b9 | 729 x Heodo, 16 x CobaltStrike, 12 x Nitol |
| 690 | 399998ecd4d46c0e | 436 x Quakbot, 137 x ArkeiStealer, 26 x Smoke Loader |
| 630 | 0000000000000000 | 141 x AgentTesla, 115 x Formbook, 62 x SnakeKeylogger |
| 388 | ead8ac9cc6e68ee0 | 118 x RaccoonStealer, 102 x RedLineStealer, 45 x Smoke Loader |
| 374 | b2dacabecee6baa6 | 113 x RedLineStealer, 58 x RaccoonStealer, 53 x Stop |
| 331 | 71e87c746071f0ec | 324 x Heodo, 6 x BazaLoader, 1 x TrickBot |
| 310 | 4839b234e8c38890 | 121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer |
| 301 | 102636b4b4343434 | 300 x Heodo, 1 x CobaltStrike |
Most discussed Malware Samples
Most discussed (commented) malware samples on MalwareBazaar.