BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details


ANY.RUN malicious database provides free access to more than 5,000,000 public reports submitted by the malware research community.







Just click on a tag to start search!

emotet nanocore agenttesla gandcrab hawkeye lokibot ursnif formbook troldesh dreambot phorpiex azorult danabot remcos jasper adwind njrat pony trickbot imminent netwire redaman ramnit quasar vidar qbot techsupport encrypted prepscram hancitor predator wannacry avemaria revenge banload revcode baldr xmrig zbot wannacryptor meterpreter socgholish servhelper innotools jacksbot gootkit betabot nemucod dunihi nymaim tofsee RigEK sogou orcus ta505 virut smoke cobaltstrike browserloot teslacrypt teamviewer zeroaccess netsupport muddywater squiblydoo softcnapp mindspark darkcomet protonbot poisonivy andromeda nocturnal icloader godzilla lavasoft sentinel unwanted addrop necurs adload floxif bancos tvrat apt28 plugx locky arkei kpot sage loda rms SecurityXploded installcapital globeimposter pandabanker isrstealer sendsafe glupteba slimware babylon empire ibryte seafko sofacy tinba pcrat xtrat gh0st qrat stop

Use advanced search to find malware samples

Sometimes you need to make special search to find specific malicious file. ANY.RUN provides you with the advanced search which is located at Public Submissions page.

  • 1
    Search by object properties, such as malware name, hash, file run type and extension.
  • 2
    Need to make a search base on behavior? Fill in verdict, specifications and tag.
  • 3
    Want to make retrospective analysis to find similar malwares? Then search by domain, IP and even by MITRE technique ID.

Leave no chance for the malware to escape your eye! Public Submission includes more than 2,000,000 tasks and all of them are accessible to you. Use malware database more often to raise your cyber defence.




Malware samples are free to download for you external analysis. Just press download sample button and unpack the archive.

P.S. The password is “infected”

Request/response content

Watch HTTP/HTTPS requests and response content, as well as, connections streams. Very useful for researching headers query.

PCAP and SSL keys

Export SSL Keys and network dump to a PCAP format for the analysis in external malware analysis software (e.g. Wireshark).

Text malware reports

text version raport

Our HTML report function allows researchers to format the result of the malware analysis online in order to share with colleagues or for printing.

We provide comprehensive information on the analysis which includes all indicators of compromises, screenshots and Process behavior graphs.

Text reports are customizable and allow excluding unneeded features and hiding sections so that excessive information does not end up in the final presentation.

  • Format your results for printing
  • Present comprehensive information with our report functions
  • Edit reports to exclude unwanted data
GO to Public tasks
Community version for