A malicious file identified by the SHA-256 hash e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b was observed twice on July 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No known exploits in the wild or affected software versions are identified. The threat is categorized as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity originating from infrastructure in Germany. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool used in attacks. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect and block this specific malicious file in security environments.
A malicious file identified by the SHA-256 hash efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE).
A malicious file identified by the SHA-256 hash dc2416a0d219b6a417f4fb1dfdcabd4e1326a13f772781be2769921291eeba7d was observed by OffSeq Mirage honeypot sensors on 2026-07-22. This file was seen 10 times in attacker activity originating from infrastructure in Great Britain. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file is likely a payload used for malicious purposes such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or patches are associated with this indicator. No known exploits in the wild or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash d079a02683cde96446dae0624843f3a0ce1641a26a75083b9aef4cc8b892343a was observed 45 times in attacker activity between July 22 and July 30, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in multiple countries including Argentina, Brazil, China, India, Jordan, Pakistan, Russia, and Sweden. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. The file was involved in attacker activity using the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during the specified date. There is no known exploit in the wild associated with this hash, and no affected software versions are identified.
A malicious file identified by the SHA-256 hash 980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc was observed twice in attacker activity on July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019 was observed twice on July 21, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. This file was seen twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits or threat actors are linked to this indicator. The observation serves as an indicator of compromise for detection and response purposes.
A malicious file identified by the SHA-256 hash 7eeb49a12710a14273958e8a5c0594987416ce88d46e57f5c28906d9ff892c1d was observed twice on July 20, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits or threat actors are currently linked to this indicator, and no affected software versions are specified.
The URL https://psychologylifecentre.com/bins/unkillbot_x86_64 was observed in attacker activity on 2026-07-20 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring attacker tools or payloads. The URL was seen four times and linked to attacker infrastructure located in the United States. It is recommended to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash d8a8cea14b12aa75047979f929bdf10b9003884580398c3c13d2b4fb04209410 was observed by OffSeq Mirage honeypot sensors on July 20, 2026. This file was detected 10 times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland and Vietnam. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
The URL chinamobile.com was observed as an attacker callback or command-and-control (C2) endpoint in the wild between 2026-07-20 and 2026-08-11. This activity was detected by OffSeq Mirage honeypot sensors 32 times and involved the use of the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in France. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e was observed by OffSeq Mirage honeypot sensors five times between July 19 and July 30, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a531f3e6224862abd00091c4955d535ace2bb886df53bdcd59c3a32b44c93629 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching against endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.