A malicious file identified by the SHA-256 hash 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702 was observed 10 times on September 7, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or vendor patches are applicable. Organizations should match this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 6a7e1676d52a85906d43a543bdb35f8b3282447a5ce8c98dfad33e04afe79dc6 was observed by OffSeq Mirage honeypot sensors 10 times between 2026-09-07 and 2026-09-11. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. This file hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during attacks. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
The PyPI package `tsshare` is malicious. It impersonates the popular Chinese market-data library `tushare` — its docstrings advertise compatibility with `Tushare pro_bar` and it ships `MyShareClient`/`MyShareError` aliases. `tsshare/client.py` conceals its default API endpoint by base64-decoding it at runtime: in 1.0.5–1.0.18 the value decodes to the hardcoded raw IP `https://47.112.191.75` (Alibaba Cloud, China), and in 1.0.19 it rotates to the domain `https://fszzw56.com`. On use, the client builds a persistent cross-platform hardware fingerprint (Windows disk-drive serial via `Win32_DiskDrive`, macOS `Hardware UUID` via `system_profiler`, Linux `/etc/machine-id`) and routes the request — carrying the user's Tushare `auth_code` token — to that hidden endpoint, so the operator receives the paid API token together with a stable machine identifier. There is no install-time hook; exfiltration occurs on API use.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (539c8fdb69887b093801655215f1857f53abb20e6dc763198c543def86c39387)
The package presents itself as a drop-in replacement for Tushare's pro_api, but every method call is dispatched through a query() that POSTs to a hardcoded default backend at https://47.112.191.75/api/v1/proxy rather than to tushare.pro. The destination URL is stored base64-encoded (_E = b"aHR0cHM6Ly80Ny4xMTIuMTkxLjc1") and decoded at runtime by _default_base_url, and the destination is a bare IP unrelated to the credential's issuer. set_token() stores the caller's Tushare auth_code, and every subsequent proxied call includes {'auth_code': self.auth_code,...} in the POST body to that endpoint, so the paid third-party credential leaves the trust boundary it was issued for and can be logged or replayed by the operator of 47.112.191.75. The client also collects a persistent hardware fingerprint on first use — PowerShell Win32_Processor ProcessorId and Win32_DiskDrive SerialNumber on Windows, system_profiler Hardware UUID on macOS, /etc/machine-id on Linux — SHA-256 hashes it, caches it under ~/.tsshare/device_id.json, and attaches it as meta.device_id to every request, giving the backend operator a stable per-machine identifier unnecessary for the advertised proxy function. TLS certificate verification on the requests.Session is disabled by default (session.verify defaults to false via TSSHARE_SSL_VERIFY/MYSHARE_SSL_VERIFY) and urllib3 InsecureRequestWarning is silenced, so the auth_code and hardware ID are transmitted to the bare-IP HTTPS endpoint without cert validation.
A malicious file identified by the SHA-256 hash 1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987 was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during this period. No specific affected software versions or exploits in the wild are reported.
A malicious file identified by the SHA-256 hash 3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious file in environments by matching it against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e was observed by OffSeq Mirage honeypot sensors in attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This file hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 was observed by OffSeq Mirage honeypot sensors during attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ed555255a37cf5daec7f617af1c5553723b47376830c666bdf036f5ea9e979e8 was observed twice on August 30, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block this specific malicious file in environments and security tools.
openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.
The IronLantern tool is a remediation and recovery utility developed to address infections by the Yogi malware, a Python 3.9/PyInstaller-based implant targeting Windows systems. Yogi malware establishes persistence through multiple mechanisms including registry Run keys and startup folder entries, creates randomized copies in user application data directories with hidden attributes, and employs a repeating-XOR ransomware encryption scheme with deterministic SHA-256-derived keys. The malware communicates with command and control servers via JSON over HTTP(S), with identified endpoints at go-ns.org.ua. IronLantern detects the exact malware sample, cleans persistence mechanisms, terminates live processes, quarantines or deletes malicious files, and recovers files encrypted by the XOR scheme. The tool and full reverse engineering report are publicly available on GitHub. No official vendor advisory or patch exists, and no known exploits in the wild have been reported.
A malicious SHA-256 file hash (4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901) was observed by OffSeq Mirage honeypot sensors on 2026-08-25. The file is associated with attacker activity using technique T1105 (Ingress Tool Transfer) and is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b was observed by OffSeq Mirage honeypot sensors on August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. No specific affected software versions or products are identified. No known exploits in the wild or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d was observed by OffSeq Mirage honeypot sensors on August 22, 2026. This file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to identify and block the malicious payload in security environments.
A malicious file identified by the SHA-256 hash 9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block the specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads during an attack. The attacker infrastructure was located in Great Britain. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. There is no evidence of known exploits in the wild for this file hash.