A malicious file identified by the SHA-256 hash f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d was observed by OffSeq Mirage honeypot sensors during attacker activity between July 18 and July 19, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in the Netherlands and the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise. No known exploits in the wild have been reported for this file. No affected software versions or patches are applicable as this is an indicator of compromise rather than a vulnerability.
A malicious file identified by the SHA-256 hash f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef was observed by OffSeq Mirage honeypot sensors during attacker activity between July 16 and July 17, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in China, Malaysia, Pakistan, and Russia. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat intelligence advises matching this hash against files in your environment and security tools. No known exploits or patches are reported for this indicator.
A malicious file identified by the SHA-256 hash f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.
A malicious file identified by the SHA-256 hash f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36 was observed 182 times in attacker activity between August 7 and August 29, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Argentina, Brazil, Canada, China, Indonesia, India, Italy, and Jordan. The hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise. No known exploits in the wild or vendor patches are applicable.
A malicious file identified by the SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 13 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Spain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was observed six times in the wild during this period. No specific affected software versions or patches are identified. No known exploits in the wild or threat actors are linked to this indicator.
A malicious file identified by the SHA-256 hash f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6c was observed by OffSeq Mirage honeypot sensors on August 6, 2026. This file was detected six times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Ethiopia, India, and Turkey. There is no known exploit in the wild or vendor patch information associated with this indicator. Organizations are advised to match this hash against files in their environment and security feeds.
A malicious file identified by the SHA-256 hash efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE).
A malicious file identified by the SHA-256 hash ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019 was observed twice on July 21, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files and threat intelligence feeds.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash ee86d4b3017ccb464b3d27332ceed33de1a9e3836e2cf55adced642d210bef7f was observed by OffSeq Mirage honeypot sensors on 2026-08-04. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Israel. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b was observed by OffSeq Mirage honeypot sensors on July 19, 2026. This file was detected 11 times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacks originating from infrastructure in the Philippines. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A malicious file identified by the SHA-256 hash ed555255a37cf5daec7f617af1c5553723b47376830c666bdf036f5ea9e979e8 was observed twice on August 30, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block this specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97 was observed by OffSeq Mirage honeypot sensors in attacker activity between September 14, 2026, and October 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash e981d296a7034bc03a3a84185b5ac07d26afc01004f55cafadfaad1c42d70f40 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash e5f1c2ec78b2d1bede0ef4502e1b9acb00ca6dcb34468937075b3c5d56f811ec was observed by OffSeq Mirage honeypot sensors on 2026-10-09. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in South Korea (KR). No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash e4e6d77040f6a91d42292fe7b8fbf9e6ca5722c940097e21a345d03b522af43d was observed 95 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769 was observed by OffSeq Mirage honeypot sensors three times between July 15 and July 18, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Croatia, the Netherlands, and the United States. This hash can be used as an indicator of compromise to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b was observed twice on July 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No known exploits in the wild or affected software versions are identified. The threat is categorized as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9 was observed 196 times in attacker activity between July 16, 2026, and August 11, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Armenia, Argentina, Australia, Bulgaria, Brazil, Canada, Côte d'Ivoire, and China. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.