Statistics

MalwareBazaar produces various statistics on malware samples shared, including their detections. The available statistics can be found below.

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 30 days.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 zbetcheckin2024-03-181'242
2 SecuriteInfoCom2024-03-19675
3 abuse_ch2024-03-19550
4 elfdigest2024-03-18164
5 adrian__luca2024-03-18143
6 Bitsight2024-03-18116
7 lowmal32024-03-18111
8 cocaman2024-03-1891
9 TeamDreier2024-03-1874
10 smica832024-03-1871
11 James_inthe_box2024-03-1858
12 malwarelabnet2024-03-1843
13 threatcat_ch2024-03-1539
14 fabiodemartin2024-03-1437
15 rmceoin2024-03-1837

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
1'026NETmalware-lu2024-03-19
957unixredflags3Tim Brown @timb_machine2024-03-18
751linux_generic_ipv6_catcher@_lubiedo2024-03-18
619Skystars_Malware_ImphashSkystars LightDefender2024-03-19
619pe_imphashNone2024-03-19
569DebuggerCheck__APINone2024-03-19
550Linux_Trojan_Gafgyt_28a2fe0cElastic Security2024-03-18
468MD5_Constantsphoul (@phoul)2024-03-19
459setsockoptTim Brown @timb_machine2024-03-18
428PE_Digital_Certificatealbertzsigovits2024-03-18
420maldoc_find_kernel32_base_method_1Didier Stevens (https://DidierStevens.com)2024-03-19
398NETexecutableMicrosoftmalware-lu2024-03-19
376maldoc_getEIP_method_1Didier Stevens (https://DidierStevens.com)2024-03-19
354meth_get_eipWilli Ballenthin2024-03-19
336PE_Potentially_Signed_Digital_Certificatealbertzsigovits2024-03-18

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
2'974afab5ded6f523d6f47110d982fde93b0724c7745906bd698fa4ea08061ecf3d0Excel file xlsx  cocaman
2'840af843dee2be7f8aac802500b3ea1c848e36cd936073250be0dfad58e842e75eeExcel file xlsx Twitter Anonymous
2'773d3782afe3265511b83642575a25df50ff73b7243b2ec188df52580a034996521Excel file xlsx  SecuriteInfoCom
2'611337beb9377f7f3fc41c3f7066cdc89d8ce3284be6acce60ca6224b0f547d8a09Excel file xlsx Twitter Anonymous
2'48145386816654e229126f004100621360ea2501c4b71eab09bddfd97785b3c42e2Excel file xlsx  James_inthe_box
2'4532027a5acbfea586f2d814fb57a97dcfce6c9d85c2a18a0df40811006d74aa7e3Word file doc  smica83
2'418c3279fd7ad2753e3cd62c08a19fd4eef271610ce3000324f3edbea927d26fc6aExcel file xlsx  cocaman
2'4061f152aca7ccc6b207e111bd8dcae7986b0678bf2a18aa827b521ca9d68dea931Excel file xlsxMatanbuchus pr0xylife
2'389adc226e020b5291cfa61e0bbb722b6bdaaa4837834c318110e71a0225f206fccExcel file xlsx  pmmkowalczyk
2'381f4cfc4b0e4edd6a42a60722f9470005d3a44820ed38142cb331ffb283d43b01eWord file docm  abuse_ch
2'356cc51e5e96d789eb389a0f280a12a73ef31fdaf0665c17631aa9f1559bb2dcfeeWord file docRemcosRAT smica83
2'3039baf20e4fa785975b10bdd4fbfed155e40550f48e4ce45dc1179f9541ae0cb2aExcel file xlsx  cocaman
2'279f69867080a0259c1d454fb4dbeb830718634b15afe7da9e4939ce5aef6ceee05Excel file xlsx  cocaman
2'2550d3ecfdd57c0f61fcb5e51c142e7c85b0f20fdd68e8c4cb8bd60009ffbbe367eWord file docm  smica83
2'243ae22f9da201032d007a0b3f54c3a53ea7a41292bba6e9855d48dd21b55c048aeWord file docSideWinder smica83

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

CAPE Sandbox CAPE Sandbox


Top detections by CAPE Sandbox for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
575f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger Loki
462eabe9054cad5152567f0699947a2c5bRiseProStealer Amadey RedLineStealer AsyncRAT
42baa93d47220682c04d92f7797d9224ceRiseProStealer Xtrat DarkComet CoinMiner
36e2a592076b17ef8bfb48b7e03965a3fcGuLoader AZORult AgentTesla RemcosRAT
3356a78d55f3f7af51443e58e0ce2fb5f6GuLoader Formbook Loki AgentTesla
26afcdf79be1557326c854b6e20cb900a7AgentTesla RemcosRAT NanoCore QuasarRAT
221f23f452093b5c1ff091a2f9fb4fa3e9GuLoader Formbook RemcosRAT AZORult
20884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
16e569e6f445d32ba23766ad67d1e3787fAdware.Generic RecordBreaker RedLineStealer GCleaner
15b34f154ec913d2d2c435cbd644e91687GuLoader RemcosRAT AgentTesla Formbook

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
298304:fFYFMbaBmH96002nBl3lGdCv5g+nWMUF2b5+J7:fiS+BmdY2BhlTvG+WMUF2b5W
2768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/qMydoom
112288:hAQng047DWb+azSyAriVIilh3J65pImubfL5WQKNlJSrsV9llPh4:xng0J+wrVIilhUzm/5WpNnSAlAgentTesla
16144:okBNJwDuCroWUZWz5l3+PsILtuJIqcDji6A1q:gD/UWMhLtuJINDu6AGCleaner
149152:CL+37ierHy79DoWOgC34a0xlkTyKdcRoKPmtw+LWcw/79afZydeO4PC29dP3k+Jv:CLMZrSZDozfw8so2mbJ8QfZHP3Sq
13072:MJDZ+6lJQTnoo3bKB/VaQxnWg5hL8IuXBi74eoC9DQlD6ObAF5R:QVaEWg5hL8IukVoC9DQlD6ObAF5RMirai
198304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+PureLogStealer
1384:FpIKp+Dm4A0PUiqNMrLWdxW7nmOEh1Bx/g3E:vp+DI0TqNMPWjW7mFlxIUGuLoader
149152:L2u9n2q9FS1VQ2mpQbGMhCwkv+0xzxl8aXadfqClE9eOW:LTJjS1VQHabGlLBxl8aXWVEAmadey
112288:sBtg6Z/jRu90UkSmo8ZgcfNI5LX+39uE0krgTT+bZQK3EP9dgNkR:JQ/jE9wojcfNIgNZEvE8ldJAgentTesla

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
76b3b2b3b2cceee7b274 x RiseProStealer, 1 x CoinMiner, 1 x Stealc
35000000000000000023 x AgentTesla, 6 x Formbook, 2 x RemcosRAT
283370ecd2ccf0339a9 x Stealc, 9 x LummaStealer, 3 x Socks5Systemz
27aae2f3e38383b62913 x AgentTesla, 9 x Formbook, 1 x AZORult
2161046962614c4e36n/a
21b2a89c96a2cada7214 x GuLoader, 3 x Formbook, 1 x AgentTesla
20b298acbab2ca7a7215 x Socks5Systemz, 2 x PureLogStealer, 2 x Adware.InstallCore
16d4d4d4d4d4d4c4c48 x Formbook, 7 x AgentTesla, 1 x SnakeKeylogger
169494b494d4aeaeac12 x DCRat, 1 x RaspberryRobin
1661e0cca8c8c871ac11 x GuLoader, 4 x Formbook, 1 x AgentTesla

Malware sample shared


The chart below shows the number of unique malware samples shared on MalwareBazaar per day over a period of 12 months.


Top Reporters


It wouldn't be possible to operate MalwareBazaar without the help of volunteers who contribute malware samples to MalwareBazaar. The table below shows the top reporters and their Twitter handle.

RankReporterLast activitySubmissions
1 abuse_ch2024-03-19163'953
2 lazyactivist1922024-01-1769'729
3 zbetcheckin2024-03-1868'889
4 Cryptolaemus12024-02-1467'833
5 Seifreed2021-10-1948'947
6 andretavare52024-01-1835'831
7 SecuriteInfoCom2024-03-1930'877
8 JAMESWT_MHT2023-04-2926'183
9 cocaman2024-03-1823'786
10 Libranalysis2024-01-1717'035
11 GovCERT_CH2022-11-1415'557
12 lowmal32024-03-1810'895
13 James_inthe_box2024-03-188'894
14 tolisec2022-07-196'610
15 adrian__luca2024-03-186'300

Top Malware Families

Top Tags

Most matching YARA rules


YARA rules that matched most on malware samples in MalwareBazaar.

Malware SamplesYARA ruleAuthorLast match
92'743Skystars_Malware_ImphashSkystars LightDefender2024-03-19
78'478SharedStringsKatie Kleemola2024-03-05
76'709Email_stealer_bin_memJames_inthe_box2023-12-09
74'503Select_from_enumerationJames_inthe_box2024-02-11
73'333UAC_bypass_bin_memJames_inthe_box2023-03-07
71'648IPPort_combo_memJames_inthe_box2024-01-01
55'576pe_imphashNone2024-03-19
51'166pe_imphash2024-03-19
45'508Cobalt_functions@j0sm12023-08-23
29'569MALWARE_Win_DLLLoaderditekSHen2022-09-07
28'709pdb_YARAify@wowabiy3142024-01-19
28'421DridexV4kevoreilly2022-09-07
28'072ach_Dridex_xls_20200528abuse.ch2022-05-06
27'015linux_generic_ipv6_catcher@_lubiedo2024-03-18
26'110unixredflags3Tim Brown @timb_machine2024-03-18

Most downloaded Malware Samples


Most downloaded malware samples on MalwareBazaar.

DownloadsMalware SampleTypeSignatureReporter
72'08670ab26000929d26e0e4e567bd0dc4158054538485fcfd51dd4b60a534967814b lzhFirebirdRAT GovCERT_CH
52'959c88a22dae5d5564a33736d8cd43835eb46153bafe47fc6e8c267c3b89d4abf04 zip  l205306
42'31859494a51618f234021c0dae2d87667ce9e431b8a75a1b4952d3e48bf71492fbbExecutable exeAgentTesla cocaman
22'8392ae29fff50afc21422c12b4e64b055df4d342fb493a667e18b6dda7ad3403857Executable exeSmoke Loader andretavare5
18'343b0413e037f2efd5eff7a1b80f339dc661bbdd8e36ef176becc12815f78577fabExecutable exeSliver pr0xylife
17'763430dbb439bf85fd2a8846a43c0b0615305ef25ac8b9496d272c2dbefd3158ed2Executable exeSnakeKeylogger abuse_ch
16'1712190623b860d6783e4c6758c057ceecb9023c3b89b824cacc74e6a9c84ed99c1Executable exeRedLineStealer abuse_ch
12'433061e17f3b2fd4a4dce1bf4f8a31198273f1abc47c32456d06fd5997ea4363578PowerPoint file pptx  Jagdtiger88mm
12'38492779228416f0dce42fd4e3d1ead5cfaecf563694391c01f421c53edd773b72ePowerPoint file pptx  cocaman
12'3234dd75e9c997abbb78aff675a28039b49ed7ebbfc2d97a4e378f7fd0d03d7e2fdPowerPoint file pptx  cocaman
12'2427e6aaa62831f2c2d26fbd3af7a7650fced824eb60c8dcbb85bb61c25a9614674PowerPoint file pptx  EldadViola
12'236b206ac5443480cdf5dfec41a5ff725efa5aa550251c908f1309f848d0ce57600PowerPoint file pptx Twitter Anonymous
12'197b97e12807dcde2a8fd53d7f8e74336442d0cf8dbed19c0a44fcef359160bdd77PowerPoint file pptx  Neiki__
12'1964e09c7b070043bd5bf50b7b2038dd170b491128eb28f5fdf61d9a07e831ece3cPowerPoint file pptx  cocaman
11'571378ddb826b406a8bdcd2358760d93822f83250ed8709ab33aa951042c85c9882Executable exeLummaStealer abuse_ch

ANY.RUN ANY.RUN


Top detections by ANY.RUN for malware samples on MalwareBazaar.

CAPE Sandbox CAPE Sandbox


Top detections by CAPE Sandbox for malware samples on MalwareBazaar.

ClamAV ClamAV


Top detections by ClamAV for malware samples on MalwareBazaar.

Intezer Intezer


Top detections by Intezer for malware samples on MalwareBazaar.

Joe Sandbox Joe Sandbox


Top detections by Joe Sandbox for malware samples on MalwareBazaar.

CERT.PL MWDB CERT.PL MWDB


Top detections by CERT.PL MWDB for malware samples on MalwareBazaar.

ReversingLabs ReversingLabs


Top detections by ReversingLabs Titanium Platform for malware samples on MalwareBazaar.

Threatray Threatray


Top detections by Threatray for malware samples on MalwareBazaar.

Triage Triage


Top detections by Triage for malware samples on MalwareBazaar.

UnpacMe UnpacMe


Top detections by UnpacMe for malware samples on MalwareBazaar.

VMRay VMRay


Top detections by VMRay for malware samples on MalwareBazaar.

FileScan.IO FileScan.IO


Top classifications by FileScan.IO for malware samples on MalwareBazaar.

Most discussed Malware Samples


Most discussed (commented) malware samples on MalwareBazaar.

CommentsMalware SampleTypeSignature
1097bb6f30d2fe5546a810da356e41652d1bccfe2130cf77dec36b9ee17c19259dExcel file xlsDridex
6d9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77bExecutable exeTrickBot
47277388a0a82e85fe6eb38ed47bd5640c74f10be64ee6e9b8610c49b73328859 7zHawkEye
3f4841b9b9006e327d58c8d6fb6e1bb3699d05fcd10fcaf7adcdde47efccb13b3 zipAgentTesla
3e97b35c4339e0412571a445b2fe20e30fe91585cad505820b56a098a66e54c23Executable exeAgentTesla
30994e0972430f7cf02b66c290b6e62666c14da2ca9ad369e7cf5447313dc8550Executable exeTrickBot
3667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83Word file docPhobos
2df822aa4ae822b89d8f1c6b4afe3f9bf4679b7c9872bd95d3cbfab366a57edcaHTML Application (hta) hta 
22b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7Executable exeStop
2251643f0b539eb872ebeb216f1b71f0f8dc8301276ea63dbfdf10a7267ac7379 zip 

Top File Types


Most seen file types associated with malware samples on MalwareBazaar.

Top imphashes


Most seen imphashes on MalwareBazaar.

Malware SampleimphashTop 4 Signatures
124'598f34d5f2d4577ed6d9ceec516c1f5a744AgentTesla Formbook SnakeKeylogger Loki
14'515646167cce332c1c252cdcb1839e0cf48RedLineStealer Amadey Smoke Loader LummaStealer
9'777c9f7e018b269f1b5fe81cf757d6f8e93Heodo
8'608987b9d7dc84d935c3675da82d40e06f2Dridex Gozi Tofsee VelvetSweatshopDridex
7'112884310b1928934402ea6fec1dbd3cf5eGCleaner Socks5Systemz RaccoonStealer RedLineStealer
3'32387bed5a7cba00c7e1f4015f1bdae2183Jadtre IcedID TrickBot Netsky
3'16161259b55b8912888e90f516ca08dc514Formbook AgentTesla GuLoader SnakeKeylogger
2'2143786a4cf8bfee8b4821db03449141df4Adware.Neoreklami RedLineStealer
2'180433637d5d88b1ab11a7e5bfc30abfe93Dridex
1'9877fa974366048f9c551ef45714595665eFormbook Loki AgentTesla SnakeKeylogger

Top ssdeep hashes


Most seen ssdeep hashes on MalwareBazaar.

Malware SamplessdeepSignature(s)
1'12412288:J2+J+l5QvSoOUkQNPRoswLLjfsHJNF05s:AJl5QrrkQFCHspN4Quakbot
1'12312288:U2+J+l5QvSoOUkQGPRoswLLjfsHJNF05F:PJl5QrrkQOCHspN4Quakbot
1'12112288:l2+J+l5QvSoOUkQiPRoswLLjfsHJNF05h:8Jl5QrrkQaCHspN4Quakbot
5281536:1I+Hymsbck3hbdlylKsgqopeJBWhZFGkE+cMLxAAISQ5gQ72IotO6nitSU6U+x:1I+HymsYk3hbdlylKsgqopeJBWhZFGkzSilentBuilder Heodo
4191536:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIzSEV2NnX4Ia3gg5W8IuD7PoHsP7e3/:H0k3hbdlylKsgqopeJBWhZFGkE+cMLxzSilentBuilder Heodo
416768:0Jlk3hbdlylKsgqopeJBWhZFGkE+cMLxAAIZEtm/piJaiyH5YnJe+eO+8WoFYpLd:0rk3hbdlylKsgqopeJBWhZFGkE+cMLx6SilentBuilder Heodo
4011536:u8rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAE6yHBEL70drpFk0GX/s2C6ORQYDBhQ:ugk3hbdlylKsgqopeJBWhZFGkE+cL2N8SilentBuilder Heodo
3733072:IFNthWQl/rSJ7lvt9filcZritkrINAEYsm2:IBhWQ/mJLflrOAp2Gozi Heodo
3513072:zs+Hyms0k3hbdlylKsgqopeJBWhZFGkE+cMLxAAIb4UgCEqM5mheHRAjNKnlGIz/:o+Hyms0k3hbdlylKsgqopeJBWhZFVE+PSilentBuilder Heodo
30712288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOmlTrickBot

Top dhash icon


Most seen dhashes of icons from PE32 executables and their signatures.

Malware Sampledhash iconSignature(s)
15'080f8f0f4c8c8c8d8f08'761 x RedLineStealer, 5'018 x Amadey, 287 x Smoke Loader
5'508b2a89c96a2cada722'276 x Formbook, 981 x Loki, 786 x AgentTesla
3'964b298acbab2ca7a722'327 x GCleaner, 1'037 x Socks5Systemz, 66 x RedLineStealer
3'85071b119dcce5763333'558 x Heodo, 202 x TrickBot, 13 x Gh0stRAT
2'607848c5454baf474741'979 x Adware.Neoreklami, 99 x RedLineStealer, 33 x DiamondFox
2'1550000000000000000670 x AgentTesla, 271 x Formbook, 201 x SnakeKeylogger
1'3379494b494d4aeaeac368 x DCRat, 161 x RedLineStealer, 134 x CryptOne
1'150fefce49e86c0fcfe884 x Socks5Systemz, 259 x RaccoonStealer
1'017399998ecd4d46c0e572 x Quakbot, 137 x ArkeiStealer, 54 x RecordBreaker
81379756cecb29999b9731 x Heodo, 20 x Nitol, 20 x ManusCrypt