A malicious file identified by the SHA-256 hash 5a58a0b98ee139ca5264d58e631e947eb124b837d7555872b184ab5a0afc1788 was observed by OffSeq Mirage honeypot sensors on July 16, 2026. The file was seen twice during attacker activity originating from infrastructure in Great Britain. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator. This is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769 was observed by OffSeq Mirage honeypot sensors three times between July 15 and July 18, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Croatia, the Netherlands, and the United States. This hash can be used as an indicator of compromise to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cd was observed 55 times in attacker activity between July 15 and July 16, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Brazil, Hungary, Indonesia, India, Iran, Pakistan, Russia, and Turkey. The hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect and block this malicious payload in affected environments.
A malicious file identified by the SHA-256 hash a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908 was observed twice on July 15, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits or threat actors are currently associated with this indicator. No affected software versions or patches are identified.
A malicious file identified by the SHA-256 hash 40db9279ba409757c074048529be5bf8f141fa022489a965792e7f7de2223b78 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 14 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash can be used as an indicator of compromise (IOC) to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7 was observed 31 times on July 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Canada, India, and Turkey. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect this threat.
A malicious file identified by the SHA-256 hash 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917 was observed by OffSeq Mirage honeypot sensors five times between July 13 and July 15, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Great Britain. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 13 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Spain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was observed six times in the wild during this period. No specific affected software versions or patches are identified. No known exploits in the wild or threat actors are linked to this indicator.
A malicious file identified by the SHA-256 hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected five times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Norway. There is no information about known exploits in the wild or affected software versions. This is an indicator of compromise to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 6ef4fcf12a66fb4f240fd1357a3e4c519f8f28e82146209168ce145d2b762991 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. There is no information about active exploitation or known threat actors linked to this file. No affected software versions or patches are specified.
A malicious file identified by the SHA-256 hash 578bfa5ed439f9d83b8197f4cf55c893c9f6447929c8df72c696fa9177213d3f was observed twice on July 12, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or affected software versions are reported. This indicator can be used to detect the presence of this malicious file in environments via file hash matching in EDR, AV, or threat intelligence feeds.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash 2985d2ce196b9d6fb2c37d601a9b13a936b90ba84c2f16dbd06b53c2a7aecb49 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a2328347ae28c0fd922ef7d919d0692444d5072cf58f32522896551fc622019a was observed by OffSeq Mirage honeypot sensors during attacker activity on July 12, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in the United States. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.
A malicious file identified by the SHA-256 hash 0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7 was observed 167 times in attacker activity between July 12 and August 1, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Bulgaria, France, Great Britain, Hong Kong, and the United States. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.