A malicious file identified by the SHA-256 hash b5eec555aa0e07b1af33a0ec195a3fb195e1543339d22305fffbfa7e6a7b4381 was observed twice on September 16, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect or block the associated malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash eaf9adb4bb80316a3aafceabc0f2ed2aed7c76cf134b9b7c66226fc4f003aa97 was observed by OffSeq Mirage honeypot sensors in attacker activity between September 14, 2026, and October 14, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 7cc0b40e8819ec9139ffae5942add2db1c26e168edaeda57302c9047f23dfb6c was observed by OffSeq Mirage honeypot sensors on 2026-09-07. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. The attacker infrastructure was located in the United States. No known exploits in the wild or specific affected software versions are identified.
A malicious file identified by the SHA-256 hash 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702 was observed 10 times on September 7, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or vendor patches are applicable. Organizations should match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6 was observed by OffSeq Mirage honeypot sensors 10 times between 2026-09-07 and 2026-09-11. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. This file hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during attacks. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A malicious file identified by the SHA-256 hash 1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987 was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during this period. No specific affected software versions or exploits in the wild are reported.
A malicious file identified by the SHA-256 hash 3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious file in environments by matching it against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This file hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 was observed by OffSeq Mirage honeypot sensors during attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ed555255a37cf5daec7f617af1c5553723b47376830c666bdf036f5ea9e979e8 was observed twice on August 30, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block this specific malicious file in environments and security tools.
A malicious SHA-256 file hash (4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901) was observed by OffSeq Mirage honeypot sensors on 2026-08-25. The file is associated with attacker activity using technique T1105 (Ingress Tool Transfer) and is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b was observed by OffSeq Mirage honeypot sensors on August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No specific affected software versions or products are identified. No known exploits in the wild or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d was observed by OffSeq Mirage honeypot sensors on August 22, 2026. This file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to identify and block the malicious payload in security environments.
A malicious file identified by the SHA-256 hash 9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block the specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads during an attack. The attacker infrastructure was located in Great Britain. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. There is no evidence of known exploits in the wild for this file hash.
A malicious file identified by the SHA-256 hash c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882 was observed by OffSeq Mirage honeypot sensors on 2026-08-22. This file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was transferred from attacker infrastructure located in Great Britain. The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information about active exploitation in the wild or specific affected software versions. The indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.