s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1859934 high

📛 Threat Title

AgendaCrypt: MD5 hash of a malware sample (payload) f6cf6f7882e162506eade5c67535ddca

Category: AgendaCrypt Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: AgendaCrypt (aliases: Agenda,Qilin). Confidence: 75. First seen: 2026-07-27 05:12:22 UTC. Reporter: TheRavenFile. Tags: agenda, qilin.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_md5 f6cf6f7882e162506eade5c67535ddca

IOC database

Type
hash_md5
Value
f6cf6f7882e162506eade5c67535ddca
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
MD5 hash of a malware sample (payload) attributed to AgendaCrypt

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • External reference ThreatFox IOCs
  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: AgendaCrypt (aliases: Agenda,Qilin). Confidence: 75. First seen: 2026-07-27 05:12:22 UTC. Reporter: TheRavenFile. Tags: agenda, qilin.

Remediations (10)

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5 , SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • AgendaCrypt — malware family IOCs & CVEs | isMalicious
    web:ismalicious.com

    194 indicators (0 domains, 0 IPs, 0 URLs, 194 hashes) attributed to the AgendaCrypt malware family.

  • AgendaCrypt (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    Qilin ransomware has been active since at least 2022. Both Golang and Rustlang samples have been observed in use. Qilin is known to operate with a Ransomwareas-a-Service (Raas) model, with double extortion (decrypter + non-release of data) tactics observed.

  • ThreatFox | deba77ce237a412331cda6c87cf62cdc
    web:threatfox.abuse.ch

    AgendaCrypt IOC: deba77ce237a412331cda6c87cf62cdc ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash deba77ce237a412331cda6c87cf62cdc.

  • ThreatFox | 22f86cec9a2f32d43673ffb8156eee4f
    web:threatfox.abuse.ch

    AgendaCrypt IOC: 22f86cec9a2f32d43673ffb8156eee4f ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 22f86cec9a2f32d43673ffb8156eee4f.

  • ThreatFox | a5d8608c6bb4874880db60edcd90bbc6
    web:threatfox.abuse.ch

    AgendaCrypt IOC: a5d8608c6bb4874880db60edcd90bbc6 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash a5d8608c6bb4874880db60edcd90bbc6.

  • ThreatFox | f1e78b13e21371ecfec02e6ca8fd5344
    web:threatfox.abuse.ch

    AgendaCrypt IOC: f1e78b13e21371ecfec02e6ca8fd5344 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash f1e78b13e21371ecfec02e6ca8fd5344.

  • ThreatFox | 4d5f56957db4b4eec9d87b64f8f5026b
    web:threatfox.abuse.ch

    AgendaCrypt IOC: 4d5f56957db4b4eec9d87b64f8f5026b ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash 4d5f56957db4b4eec9d87b64f8f5026b.

  • ThreatFox | f6cf6f7882e162506eade5c67535ddca
    web:threatfox.abuse.ch

    AgendaCrypt IOC: f6cf6f7882e162506eade5c67535ddca ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash f6cf6f7882e162506eade5c67535ddca .

  • ThreatFox | eb6fff4ee0f03ae5191f11570ff221c5
    web:threatfox.abuse.ch

    AgendaCrypt IOC: eb6fff4ee0f03ae5191f11570ff221c5 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash eb6fff4ee0f03ae5191f11570ff221c5.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.