A malicious file identified by the SHA-256 hash b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e was observed by OffSeq Mirage honeypot sensors on July 27, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d was observed by OffSeq Mirage honeypot sensors on August 22, 2026. This file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to identify and block the malicious payload in security environments.
A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash b5149190ab5cdfcee95c4aa201bdd0229f426d3bbf6d2cd45d0e983f120b94b7 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was seen 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash b48d39eafd924b042bdfae32f0e19b0e9ff870b46d46f6ca7859e9dfc5a927d7 was observed 31 times on July 14, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Canada, India, and Turkey. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect this threat.
A malicious file identified by the SHA-256 hash b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity originating from infrastructure in Germany. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool used in attacks. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. No known exploits in the wild or specific affected software versions are identified. The indicator is intended for matching against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793 was observed by OffSeq Mirage honeypot sensors three times between September 25 and October 8, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.
A malicious file identified by the SHA-256 hash abcaddee7bcb727818464f54737eb2547a406215fcff914d5c270204030aacd7 was observed by OffSeq Mirage honeypot sensors on July 18, 2026. The file was seen four times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and China. This indicator can be used to detect or block the associated malicious file in security environments.
A malicious file identified by the SHA-256 hash ab8d6adf1976431e290cc6d5991f0e23dfc450ee89463b0bcf8191601c0cc0c4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 30 and August 1, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash a6ea67372e5b31bfd633d9745541577e9f3edb39f0eea75cf9679b632ca04908 was observed twice on July 15, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits or threat actors are currently associated with this indicator. No affected software versions or patches are identified.
A malicious file identified by the SHA-256 hash a64aadbc9c68fad12433ca75b2ded3c70db9a73ada83c7abf4882b04cd91f500 was observed by OffSeq Mirage honeypot sensors six times between July 23 and July 26, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was transferred from attacker infrastructure. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. No known exploits or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash a6296a79f44e21b76604d2d2bbf795d2cf380f70e39d45fbf166707ff3b4a6a4 was observed 56 times in attacker activity between August 15 and September 9, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Bulgaria, Brazil, Chile, China, Colombia, Germany, and Hong Kong. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash a531f3e6224862abd00091c4955d535ace2bb886df53bdcd59c3a32b44c93629 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching against endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this file hash in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash a330fdc4266c2163a661aab758c06d52de0e923872dfb95f16f371183d4280f0 was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in MU. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
A malicious file identified by the SHA-256 hash a2328347ae28c0fd922ef7d919d0692444d5072cf58f32522896551fc622019a was observed by OffSeq Mirage honeypot sensors during attacker activity on July 12, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in the United States. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 was observed 9 times on 2026-10-24 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations should match this hash against files in their environments and threat intelligence feeds to detect potential compromise.