A malicious file identified by the SHA-256 hash 40db9279ba409757c074048529be5bf8f141fa022489a965792e7f7de2223b78 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 14 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash can be used as an indicator of compromise (IOC) to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7 was observed 31 times on July 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Canada, India, and Turkey. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect this threat.
A malicious file identified by the SHA-256 hash 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917 was observed by OffSeq Mirage honeypot sensors five times between July 13 and July 15, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Great Britain. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 13 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Spain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was observed six times in the wild during this period. No specific affected software versions or patches are identified. No known exploits in the wild or threat actors are linked to this indicator.
A malicious file identified by the SHA-256 hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected five times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Norway. There is no information about known exploits in the wild or affected software versions. This is an indicator of compromise to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 6ef4fcf12a66fb4f240fd1357a3e4c519f8f28e82146209168ce145d2b762991 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. There is no information about active exploitation or known threat actors linked to this file. No affected software versions or patches are specified.
A malicious file identified by the SHA-256 hash 578bfa5ed439f9d83b8197f4cf55c893c9f6447929c8df72c696fa9177213d3f was observed twice on July 12, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or affected software versions are reported. This indicator can be used to detect the presence of this malicious file in environments via file hash matching in EDR, AV, or threat intelligence feeds.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash 2985d2ce196b9d6fb2c37d601a9b13a936b90ba84c2f16dbd06b53c2a7aecb49 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a2328347ae28c0fd922ef7d919d0692444d5072cf58f32522896551fc622019a was observed by OffSeq Mirage honeypot sensors during attacker activity on July 12, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in the United States. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.
A malicious file identified by the SHA-256 hash 0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7 was observed 167 times in attacker activity between July 12 and August 1, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Bulgaria, France, Great Britain, Hong Kong, and the United States. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 1dee0949441736015e60e2f4589a8855dbd19fcf9387946cf20ef2fed246ad7a was observed 409 times in attacker activity between July 11, 2026, and August 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 9f44bf644db7bdaee5ffdbe66b5db29861fe10aa39ce3ed1738b1bc15a5ce6da was observed by OffSeq Mirage honeypot sensors during attacker activity between July 11 and July 12, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in China, India, Pakistan, and Sweden. This indicator is intended for matching against files in environments and security feeds to detect potential malicious activity.
The URL www.interact.sh has been observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors five times between June 29, 2026, and October 22, 2026. The activity involved the use of the MITRE ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified in France, Turkey, and the United States. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28, 2026, and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments.
A malicious file identified by the SHA-256 hash 59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Germany and the United Kingdom. No known exploits or threat actors are currently linked to this indicator. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7 was observed in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. Organizations are advised to match this hash against files in their environments and security tools.
A malicious file identified by the SHA-256 hash dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9 was observed by OffSeq Mirage honeypot sensors in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This indicator can be used to detect or block the malicious payload in affected environments.
A malicious file identified by the SHA-256 hash 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes.