A malicious SHA-256 file hash (4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901) was observed by OffSeq Mirage honeypot sensors on 2026-08-25. The file is associated with attacker activity using technique T1105 (Ingress Tool Transfer) and is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 41f06f992406b144eaa87a5a91961a8ab4e46d9a38fc94e03ccd644a97252949 was observed by OffSeq Mirage honeypot sensors five times between July 29, 2026, and August 2, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 41973e5dc419ef5d31ba3c0b984ae22d80dddd15d3bf65696e7e0c919134430f was observed twice in attacker activity on August 8, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This file hash serves as an indicator of compromise (IOC) for detection and response efforts.
A malicious file identified by the SHA-256 hash 40db9279ba409757c074048529be5bf8f141fa022489a965792e7f7de2223b78 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 14 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash can be used as an indicator of compromise (IOC) to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect and block this specific malicious file in security environments.
A malicious file identified by the SHA-256 hash 39be6853a8204ce6455a373a6ffb4cb4672d4a62d90be69f7d6eeb66cda10b96 was observed 12 times in attacker activity between September 18, 2026, and October 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in South Carolina. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f was observed by OffSeq Mirage honeypot sensors during attacker activity between June 28 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany and Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads during an attack. The attacker infrastructure was located in Great Britain. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. There is no evidence of known exploits in the wild for this file hash.
A malicious file identified by the SHA-256 hash 31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e was observed by OffSeq Mirage honeypot sensors five times between July 19 and July 30, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 31087290fc269af7921f9591418ac5d0baff3304bc3a18bc7b614546766586e9 was observed by OffSeq Mirage honeypot sensors on 2026-10-24. This file was detected 9 times in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information on affected software versions or known exploits in the wild. The file hash serves as an indicator of compromise (IOC) to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917 was observed by OffSeq Mirage honeypot sensors five times between July 13 and July 15, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Great Britain. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 2985d2ce196b9d6fb2c37d601a9b13a936b90ba84c2f16dbd06b53c2a7aecb49 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. The file was involved in attacker activity using the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during the specified date. There is no known exploit in the wild associated with this hash, and no affected software versions are identified.
A malicious file identified by the SHA-256 hash 201b1a44204bb8e3ade6a1694512c86f6b1067b07e8008e3434ac80e78dd5c31 was observed by OffSeq Mirage honeypot sensors on July 17, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in Brazil and Iran. There is no known exploit in the wild or vendor patch information associated with this indicator. Organizations are advised to match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 1ecfe3ec7b25893dc55c0ed14196a817f1edd0469cca0a6ad42974d0eccbf146 was observed by OffSeq Mirage honeypot sensors on October 9, 2026. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. This hash can be used as an indicator of compromise to detect the presence of this specific malicious payload in environments and security tools. No specific software versions or patches are applicable. No known exploits or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash 1dee0949441736015e60e2f4589a8855dbd19fcf9387946cf20ef2fed246ad7a was observed 409 times in attacker activity between July 11, 2026, and August 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 1984be06964df21243c08368f5497a050709ac64fce32c718389b60a04bd3870 was observed multiple times in attacker activity from October 21 to October 24, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in South Korea and the United States. This indicator can be used to detect or block the malicious payload in affected environments.
A malicious file identified by the SHA-256 hash 15dfb2762480c825beb4f3cf3c57becf9386c02065f23525604fef2c8992f280 was observed by OffSeq Mirage honeypot sensors 58 times during attacker activity between August 13 and August 14, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is associated with a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Brazil, Chile, China, Hong Kong, Luxembourg, Pakistan, and Saudi Arabia. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 154d5729d26ae38ff37e7d1463a019d259da7c0f9a37e4482333e1e686ebe39e was observed by OffSeq Mirage honeypot sensors on July 18, 2026. This file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The file was associated with attacker infrastructure located in Brazil and Iran. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 135cefead339d5e0813e38049da8666efefef7c7b64c6ed22f5fec62b676ced1 was observed by OffSeq Mirage honeypot sensors on August 8, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash can be used as an indicator of compromise to detect the presence of this malicious file in environments and security tools.