A malicious file identified by the SHA-256 hash 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417 was observed in attacker activity between October 14 and October 24, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was detected by OffSeq Mirage honeypot sensors. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Brazil and Italy. This indicator can be used to match against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 792a633371540ee9695ed6923f566de4a41cdaec6883e5b537d8ef848ee8636e was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions or geographic targeting are indicated. No known exploits in the wild or threat actors are associated with this indicator at this time.
A malicious file identified by the SHA-256 hash 783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28, 2026, and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments.
A malicious file identified by the SHA-256 hash 752f690e3926fc04088edfb0cb06f679f4a2e44f88e7d0d9aa16d3ebf8db99cf was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Bulgaria. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or CVE identifiers are associated with this indicator. There is no known exploit in the wild linked to this file hash at this time.
A malicious file identified by the SHA-256 hash 74ef10b3118313e6f1a26b71b60b5b978f193c796c1ec24a57cf2832334ff8c7 was observed multiple times in attacker activity between July 25 and July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash 6ef4fcf12a66fb4f240fd1357a3e4c519f8f28e82146209168ce145d2b762991 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. There is no information about active exploitation or known threat actors linked to this file. No affected software versions or patches are specified.
A malicious file identified by the SHA-256 hash 6da698e64fba6eceba3457ffe1b5f844c8f155f46825da36ed67b4db66ef12af was observed by OffSeq Mirage honeypot sensors three times between July 27 and July 31, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload may be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Bulgaria. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6 was observed by OffSeq Mirage honeypot sensors 10 times between 2026-09-07 and 2026-09-11. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. This file hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during attacks. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A malicious file identified by the SHA-256 hash 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Germany. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits in the wild or affected software versions are identified. The indicator is intended for matching against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 63952f1d3a85ae646317fd592027e258e1dbbba8c7bd4822e2551b9f0a4f8315 was observed 64 times in attacker activity between July 18 and July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Brazil, China, Indonesia, India, Iran, Italy, Pakistan, and Thailand. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 5f3709aa1823bc153c63dc5d0bccab9fbf9e252a910a08a639e857bd9f8f0149 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. The hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 5f0f014674efd7ae577b0cce3b2a056dcae394d81c5ab5c09b311cf5f2fbb83c was observed by OffSeq Mirage honeypot sensors on 2026-07-28. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This indicator is intended for matching against files in environments and security feeds to detect potential compromise. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash 5b694a7351bb12f07ad0d3bde910eacd5debeccdfcdb52081317e4da944cb730 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in MU. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available for this indicator. Organizations should match this hash against their environments and security tools to detect potential presence.
A malicious file identified by the SHA-256 hash 5a58a0b98ee139ca5264d58e631e947eb124b837d7555872b184ab5a0afc1788 was observed by OffSeq Mirage honeypot sensors on July 16, 2026. The file was seen twice during attacker activity originating from infrastructure in Great Britain. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator. This is an indicator of compromise (IOC) useful for detection and response efforts.
A malicious file identified by the SHA-256 hash 59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5 was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Germany and the United Kingdom. No known exploits or threat actors are currently linked to this indicator. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 578bfa5ed439f9d83b8197f4cf55c893c9f6447929c8df72c696fa9177213d3f was observed twice on July 12, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or affected software versions are reported. This indicator can be used to detect the presence of this malicious file in environments via file hash matching in EDR, AV, or threat intelligence feeds.
A malicious file identified by the SHA-256 hash 561b9327e87addc615ec1c93342af9227faf8bc904218ad513cf86b8ff26a467 was observed by OffSeq Mirage honeypot sensors eight times between August 18 and August 26, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain and the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 51b052a524af278366fb5527d4a5eee949b63f85168c37d4f97aefe3e73fe66a was observed by OffSeq Mirage honeypot sensors in attacker activity between August 16 and September 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. The hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. This file was seen twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits or threat actors are linked to this indicator. The observation serves as an indicator of compromise for detection and response purposes.
A malicious file identified by the SHA-256 hash 4af5a5c98ad132095c6fbe7b02c242153a190a01cc321e50a916a0ca46fbaa62 was observed 618 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.