A malicious file identified by the SHA-256 hash a330fdc4266c2163a661aab758c06d52de0e923872dfb95f16f371183d4280f0 was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in MU. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 6da698e64fba6eceba3457ffe1b5f844c8f155f46825da36ed67b4db66ef12af was observed by OffSeq Mirage honeypot sensors three times between July 27 and July 31, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload may be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Bulgaria. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e was observed by OffSeq Mirage honeypot sensors on July 27, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash da6d923c304f3844fb563ec63a9ff3b62f5cc177335192dfbc55667d24d9308d was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was observed from attacker infrastructure located in MU. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 805a01d5cda9cf31423b7fc2cc70165098505500c9107bb47b4303c0a60cb208 was observed twice on July 26, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958 was observed twice in attacker activity on July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The activity was detected by OffSeq Mirage honeypot sensors and linked to attacker infrastructure in MU. There is no information on known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash dc8586402cbd86a2593fab196f3ced051326c21120144264492c07c5d91f2cfa was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG).
A malicious file identified by the SHA-256 hash 5b694a7351bb12f07ad0d3bde910eacd5debeccdfcdb52081317e4da944cb730 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in MU. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available for this indicator. Organizations should match this hash against their environments and security tools to detect potential presence.
A malicious file identified by the SHA-256 hash 752f690e3926fc04088edfb0cb06f679f4a2e44f88e7d0d9aa16d3ebf8db99cf was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Bulgaria. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or CVE identifiers are associated with this indicator. There is no known exploit in the wild linked to this file hash at this time.
A malicious file identified by the SHA-256 hash c43795d89b5cbde3f1b16fea18fb586e024a23ac4e2fbb48a0a18dd851a45876 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that may be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG). No known exploits in the wild or vendor patches are reported. Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash e144da3f5a982d5ed3a6c4edfa98bbfdc83fca9f67791f83123801061dc12eb4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 25 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 74ef10b3118313e6f1a26b71b60b5b978f193c796c1ec24a57cf2832334ff8c7 was observed multiple times in attacker activity between July 25 and July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash d1515ff3e467c83dff345353f38acc27ac1788964a7b5a320fb2f3b1c0eb63a6 was observed by OffSeq Mirage honeypot sensors 80 times between July 25 and July 27, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Bulgaria (BG). Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file originated from attacker infrastructure located in MU. This indicator can be used to detect or block the associated malicious payload in affected environments.
A malicious file identified by the SHA-256 hash b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. No known exploits in the wild or specific affected software versions are identified. The indicator is intended for matching against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 9ab6e598d685e617ad0194d390257dc2061124a5b44ba003b8caa7d6c40516d6 was observed by OffSeq Mirage honeypot sensors on July 25, 2026. The file was detected twice in attacker activity originating from infrastructure in Mauritius (MU). The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There are no known exploits in the wild associated with this file hash, and no affected software versions are specified.
The URL sbc.questblue.com was observed in the wild as an attacker callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors on July 24, 2026, with two occurrences noted. The technique involved is T1071, which relates to the use of application layer protocols for command and control. The attacker infrastructure was identified as originating from Finland (FI).
A malicious file identified by the SHA-256 hash 01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9 was observed by OffSeq Mirage honeypot sensors four times between July 23 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no information on active exploitation in the wild or known threat actors associated with this hash. No affected software versions or patches are applicable as this is an indicator of compromise rather than a software vulnerability.
A malicious file identified by the SHA-256 hash 9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034 was observed by OffSeq Mirage honeypot sensors 10 times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is provided.
A malicious file identified by the SHA-256 hash cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b was observed by OffSeq Mirage honeypot sensors five times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was seen originating from attacker infrastructure located in MU. No known exploits in the wild or vendor patches are indicated. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.