A malicious file identified by the SHA-256 hash e4e6d77040f6a91d42292fe7b8fbf9e6ca5722c940097e21a345d03b522af43d was observed 95 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash e374a7ad447d2cf791ecae122894a51ba723901ea132e7fa16cd47c44e4a1769 was observed by OffSeq Mirage honeypot sensors three times between July 15 and July 18, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Croatia, the Netherlands, and the United States. This hash can be used as an indicator of compromise to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b was observed twice on July 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No known exploits in the wild or affected software versions are identified. The threat is categorized as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9 was observed 196 times in attacker activity between July 16, 2026, and August 11, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Armenia, Argentina, Australia, Bulgaria, Brazil, Canada, Côte d'Ivoire, and China. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash e144da3f5a982d5ed3a6c4edfa98bbfdc83fca9f67791f83123801061dc12eb4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 25 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash dc8586402cbd86a2593fab196f3ced051326c21120144264492c07c5d91f2cfa was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG).
A malicious file identified by the SHA-256 hash dc2416a0d219b6a417f4fb1dfdcabd4e1326a13f772781be2769921291eeba7d was observed by OffSeq Mirage honeypot sensors on 2026-07-22. This file was seen 10 times in attacker activity originating from infrastructure in Great Britain. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file is likely a payload used for malicious purposes such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or patches are associated with this indicator. No known exploits in the wild or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9 was observed by OffSeq Mirage honeypot sensors in attacker activity between 2026-06-28 and 2026-07-15. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This indicator can be used to detect or block the malicious payload in affected environments.
A malicious file identified by the SHA-256 hash da6d923c304f3844fb563ec63a9ff3b62f5cc177335192dfbc55667d24d9308d was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was observed from attacker infrastructure located in MU. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash d8a8cea14b12aa75047979f929bdf10b9003884580398c3c13d2b4fb04209410 was observed by OffSeq Mirage honeypot sensors on July 20, 2026. This file was detected 10 times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland and Vietnam. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash d6bb2dc0431405c4158cc15ed0171fd3a53986bc79149ada27dec7b1edcf5b14 was observed by OffSeq Mirage honeypot sensors on July 19, 2026. The file was seen six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Brazil. There is no information about known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash d5d4249912afc83472420ec77c8a97081800436df1e31d14bb814649e084e061 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The threat is an indicator of compromise (IOC) rather than a vulnerability or exploit itself. No known exploits or threat actors are associated with this hash, and no affected software versions or countries are specified.
A malicious file identified by the SHA-256 hash d487a3bbd941c891d83433d955b05d9a569a04a61f8dc6b33b79c8842dc42100 was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash d1515ff3e467c83dff345353f38acc27ac1788964a7b5a320fb2f3b1c0eb63a6 was observed by OffSeq Mirage honeypot sensors 80 times between July 25 and July 27, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Bulgaria (BG). Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash d079a02683cde96446dae0624843f3a0ce1641a26a75083b9aef4cc8b892343a was observed 45 times in attacker activity between July 22 and July 30, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in multiple countries including Argentina, Brazil, China, India, Jordan, Pakistan, Russia, and Sweden. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file originated from attacker infrastructure located in MU. This indicator can be used to detect or block the associated malicious payload in affected environments.
A malicious file identified by the SHA-256 hash cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b was observed by OffSeq Mirage honeypot sensors five times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was seen originating from attacker infrastructure located in MU. No known exploits in the wild or vendor patches are indicated. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash cc0e9d0184c0b930381446b6891769a35711b38c6a57303482e3115f921d4edc was observed 26 times in attacker activity between October 13 and October 21, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads into target environments. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Hong Kong, India, South Korea, Taiwan, and the United States. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash cac00f4de01f0b46d9646e425ae88152df96d7393c98099f2a373e86dbd56176 was observed by OffSeq Mirage honeypot sensors 79 times between July 31, 2026, and August 5, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries, but no specific targeted countries are confirmed. There is no known exploit in the wild or vendor patch information related to this file hash. This is an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash ca2af697388746b2381dc7c4e857ffcec86223ea4618de4583437380050d7770 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.