A malicious file identified by the SHA-256 hash e981d296a7034bc03a3a84185b5ac07d26afc01004f55cafadfaad1c42d70f40 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this file hash in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 8ec920a35a7c6dd60e4aeb3b1ed09cd344f4c5191d4314a05ce72bf757377c86 was observed in attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was detected twice by OffSeq Mirage honeypot sensors. No known exploits in the wild or affected software versions are reported.
A malicious file identified by the SHA-256 hash f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
An attacker URL https://psychologylifecentre.com/bins/$b was observed in the wild by OffSeq Mirage honeypot sensors 38 times between July 19 and July 21, 2026. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified in the Philippines and the United States. Defenders are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b was observed by OffSeq Mirage honeypot sensors on July 19, 2026. This file was detected 11 times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacks originating from infrastructure in the Philippines. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A URL associated with attacker activity was observed multiple times in the wild on July 19, 2026. The URL, hosted on sistemasyusa.icu, was linked to an attacker payload involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This URL was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from the Philippines. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash d6bb2dc0431405c4158cc15ed0171fd3a53986bc79149ada27dec7b1edcf5b14 was observed by OffSeq Mirage honeypot sensors on July 19, 2026. The file was seen six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Brazil. There is no information about known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d was observed by OffSeq Mirage honeypot sensors during attacker activity between July 18 and July 19, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in the Netherlands and the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise. No known exploits in the wild have been reported for this file. No affected software versions or patches are applicable as this is an indicator of compromise rather than a vulnerability.
A malicious file identified by the SHA-256 hash 63952f1d3a85ae646317fd592027e258e1dbbba8c7bd4822e2551b9f0a4f8315 was observed 64 times in attacker activity between July 18 and July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Brazil, China, Indonesia, India, Iran, Italy, Pakistan, and Thailand. This indicator should be matched against files in environments and security tools to detect potential compromise.
A URL associated with attacker activity was observed multiple times on July 18, 2026. The URL, https://sistemasyusa.icu/admin/productimages/b, was detected by OffSeq Mirage honeypot sensors and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as originating from the Philippines. This URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software vulnerability or exploit code is detailed.
A URL hosting an attacker payload script (http://bins.oceanic-node.su/wget.sh) was observed multiple times in attacker activity between July and August 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for tool download or callback. The attacker infrastructure was identified in Hong Kong, South Korea, and Taiwan. This URL is considered an indicator of compromise and should be blocked and monitored in network defenses.
A malicious file identified by the SHA-256 hash 154d5729d26ae38ff37e7d1463a019d259da7c0f9a37e4482333e1e686ebe39e was observed by OffSeq Mirage honeypot sensors on July 18, 2026. This file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The file was associated with attacker infrastructure located in Brazil and Iran. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash abcaddee7bcb727818464f54737eb2547a406215fcff914d5c270204030aacd7 was observed by OffSeq Mirage honeypot sensors on July 18, 2026. The file was seen four times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and China. This indicator can be used to detect or block the associated malicious file in security environments.
A malicious file identified by the SHA-256 hash 201b1a44204bb8e3ade6a1694512c86f6b1067b07e8008e3434ac80e78dd5c31 was observed by OffSeq Mirage honeypot sensors on July 17, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Brazil and Iran. There is no known exploit in the wild or vendor patch information associated with this indicator. Organizations are advised to match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9 was observed 196 times in attacker activity between July 16, 2026, and August 11, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Armenia, Argentina, Australia, Bulgaria, Brazil, Canada, Côte d'Ivoire, and China. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef was observed by OffSeq Mirage honeypot sensors during attacker activity between July 16 and July 17, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in China, Malaysia, Pakistan, and Russia. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat intelligence advises matching this hash against files in your environment and security tools. No known exploits or patches are reported for this indicator.