A malicious file identified by the SHA-256 hash ca2af697388746b2381dc7c4e857ffcec86223ea4618de4583437380050d7770 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882 was observed by OffSeq Mirage honeypot sensors on 2026-08-22. This file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was transferred from attacker infrastructure located in Great Britain. The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information about active exploitation in the wild or specific affected software versions. The indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash c43795d89b5cbde3f1b16fea18fb586e024a23ac4e2fbb48a0a18dd851a45876 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that may be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG). No known exploits in the wild or vendor patches are reported. Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash c38eaf2b436cefd15e73bfa0a143d996cac708c1bccc9d3ce9b371b418e85595 was observed twice on October 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b was observed by OffSeq Mirage honeypot sensors on August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No specific affected software versions or products are identified. No known exploits in the wild or threat actors are linked to this indicator at this time.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash bf20fa97c5afa6cb4d25611fb5a6b9d1fc3dc18ecb07f6ba1bd80d9de05ad5b2. This file was observed twice on July 28, 2026, associated with attacker activity involving the T1105 technique (Ingress Tool Transfer). The hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is available.
A malicious file identified by the SHA-256 hash bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440 was observed by OffSeq Mirage honeypot sensors five times between September 19, 2026, and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e was observed by OffSeq Mirage honeypot sensors on July 27, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d was observed by OffSeq Mirage honeypot sensors on August 22, 2026. This file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to identify and block the malicious payload in security environments.
A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash b5149190ab5cdfcee95c4aa201bdd0229f426d3bbf6d2cd45d0e983f120b94b7 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was seen 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7 was observed 31 times on July 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Canada, India, and Turkey. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect this threat.
A malicious file identified by the SHA-256 hash b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity originating from infrastructure in Germany. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool used in attacks. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. No known exploits in the wild or specific affected software versions are identified. The indicator is intended for matching against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 was observed by OffSeq Mirage honeypot sensors three times between September 25 and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.
A malicious file identified by the SHA-256 hash abcaddee7bcb727818464f54737eb2547a406215fcff914d5c270204030aacd7 was observed by OffSeq Mirage honeypot sensors on July 18, 2026. The file was seen four times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and China. This indicator can be used to detect or block the associated malicious file in security environments.
A malicious file identified by the SHA-256 hash ab8d6adf1976431e290cc6d5991f0e23dfc450ee89463b0bcf8191601c0cc0c4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 30 and August 1, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908 was observed twice on July 15, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits or threat actors are currently associated with this indicator. No affected software versions or patches are identified.