A malicious file identified by the SHA-256 hash 9f44bf644db7bdaee5ffdbe66b5db29861fe10aa39ce3ed1738b1bc15a5ce6da was observed by OffSeq Mirage honeypot sensors during attacker activity between July 11 and July 12, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in China, India, Pakistan, and Sweden. This indicator is intended for matching against files in environments and security feeds to detect potential malicious activity.
A malicious file identified by the SHA-256 hash 9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block the specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 9ab6e598d685e617ad0194d390257dc2061124a5b44ba003b8caa7d6c40516d6 was observed by OffSeq Mirage honeypot sensors on July 25, 2026. The file was detected twice in attacker activity originating from infrastructure in Mauritius (MU). The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There are no known exploits in the wild associated with this file hash, and no affected software versions are specified.
A malicious file identified by the SHA-256 hash 980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc was observed twice in attacker activity on July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034 was observed by OffSeq Mirage honeypot sensors 10 times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is provided.
A malicious file identified by the SHA-256 hash 92a919c18841e8ff2a2e1165a3d446f06fba4e866f7e6d8fd6dd4933e43985f8 was observed by OffSeq Mirage honeypot sensors on 2026-07-31. The file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. This indicator can be used to match against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 8f312413d911af37f7636c63f33fb48b5f6d15c68a04a3db42a3189e24690d3f was observed by OffSeq Mirage honeypot sensors four times between July 30 and August 1, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This indicator can be used to detect or block the malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 8ec920a35a7c6dd60e4aeb3b1ed09cd344f4c5191d4314a05ce72bf757377c86 was observed in attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was detected twice by OffSeq Mirage honeypot sensors. No known exploits in the wild or affected software versions are reported.
A malicious file identified by the SHA-256 hash 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702 was observed 10 times on September 7, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or vendor patches are applicable. Organizations should match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 8a34152174b8009549359c9dd2407bd93c80e7dc3d0dedebdf8df423ccbdeacf was observed by OffSeq Mirage honeypot sensors on October 11, 2026. This file was detected six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and Ukraine. Organizations should check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 89e89ac00b0c3adcf25435c19dfc828d87e5bb311c9a858f56e8463b14b3e254 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. No specific affected software versions or exploits in the wild are reported. The file hash serves as an indicator of compromise for detection and response efforts.
A malicious file identified by the SHA-256 hash 87da5dd36a95e1c0acbaff137a56d94a9339fdcf42577974b53fbd6f69c11219 was observed twice on July 28, 2026, by OffSeq Mirage honeypot sensors. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was transferred from attacker infrastructure located in MU. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific software versions or exploits in the wild are reported. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 848f1546a84dd92cce3c1463e3e964698533d93d6ea7be00e000db5efbb1d2f4 was observed by OffSeq Mirage honeypot sensors eight times between August 6 and August 11, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Chile (CL) and China (CN). There is no known exploit in the wild or vendor patch information available. Organizations are advised to match this hash against files in their environment and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 81a7cdbbf15c84b01f5144fa45f4148dd12a373df07ea37850510cc3b0694d92 was observed by OffSeq Mirage honeypot sensors on 2026-10-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected five times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Norway. There is no information about known exploits in the wild or affected software versions. This is an indicator of compromise to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 805a01d5cda9cf31423b7fc2cc70165098505500c9107bb47b4303c0a60cb208 was observed twice on July 26, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 7eeb49a12710a14273958e8a5c0594987416ce88d46e57f5c28906d9ff892c1d was observed twice on July 20, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits or threat actors are currently linked to this indicator, and no affected software versions are specified.
A malicious file identified by the SHA-256 hash 7cc0b40e8819ec9139ffae5942add2db1c26e168edaeda57302c9047f23dfb6c was observed by OffSeq Mirage honeypot sensors on 2026-09-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. The attacker infrastructure was located in the United States. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417 was observed in attacker activity between October 14 and October 24, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and Italy. This indicator can be used to match against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.