OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash 1193dde1c831808bf6f2db6f5b850b846b8a7f870873ec3b8a347f21cc5d96e3 during attacker activity on 2026-06-28 and 2026-06-29. The file is linked to the ATT&CK technique T1105, which involves ingress tool transfer, suggesting the file was used to deliver or stage a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This hash serves as an IOC to identify this specific malicious payload in affected environments. There is no information on specific affected software versions or known active exploitation campaigns.

The presence of this malicious file indicates potential compromise involving the transfer and execution of unauthorized tools or payloads within a network. Such payloads may enable attackers to establish persistence, escalate privileges, or conduct further malicious activities. However, no confirmed active exploitation or widespread impact has been reported at this time.

No official patch or remediation is applicable as this is an indicator of compromise rather than a vulnerability. Security teams should use this SHA-256 hash to scan and detect the presence of this malicious file within their environments using EDR, AV, and threat intelligence feeds. If detected, incident response procedures should be followed to contain and remediate the infection. Continuous monitoring for ingress tool transfer activities (T1105) is recommended.