A malicious file identified by the SHA-256 hash 9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect and block the specific malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash 344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369 was observed by OffSeq Mirage honeypot sensors three times between August 22 and August 23, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools or payloads during an attack. The attacker infrastructure was located in Great Britain. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. There is no evidence of known exploits in the wild for this file hash.
A malicious file identified by the SHA-256 hash c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882 was observed by OffSeq Mirage honeypot sensors on 2026-08-22. This file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was transferred from attacker infrastructure located in Great Britain. The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There is no information about active exploitation in the wild or specific affected software versions. The indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40 was observed by OffSeq Mirage honeypot sensors four times between August 22 and August 23, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This hash serves as an indicator of compromise (IOC) for detection and response purposes. No known exploits or threat actors are currently associated with this file, and no affected software versions are specified.
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
An attacker-controlled URL (da4ms7supagd531da040xszuj79z5wgss.oast.site) was observed in the wild on 2026-08-22 by OffSeq Mirage honeypot sensors. This URL was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The activity was seen originating from attacker infrastructure in Turkey. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 561b9327e87addc615ec1c93342af9227faf8bc904218ad513cf86b8ff26a467 was observed by OffSeq Mirage honeypot sensors eight times between August 18 and August 26, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain and the Netherlands. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
The URL http://vps.atlas101.us.kg:7768/dl.sh was observed in attacker activity by OffSeq Mirage honeypot sensors on August 17, 2026. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring tools or payloads during attacks. The attacker infrastructure was identified as originating from Bulgaria. This URL has been seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 51b052a524af278366fb5527d4a5eee949b63f85168c37d4f97aefe3e73fe66a was observed by OffSeq Mirage honeypot sensors in attacker activity between August 16 and September 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in China. The hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash a6296a79f44e21b76604d2d2bbf795d2cf380f70e39d45fbf166707ff3b4a6a4 was observed 56 times in attacker activity between August 15 and September 9, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Bulgaria, Brazil, Chile, China, Colombia, Germany, and Hong Kong. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 15dfb2762480c825beb4f3cf3c57becf9386c02065f23525604fef2c8992f280 was observed by OffSeq Mirage honeypot sensors 58 times during attacker activity between August 13 and August 14, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is associated with a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Argentina, Brazil, Chile, China, Hong Kong, Luxembourg, Pakistan, and Saudi Arabia. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 5f3709aa1823bc153c63dc5d0bccab9fbf9e252a910a08a639e857bd9f8f0149 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. The hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 135cefead339d5e0813e38049da8666efefef7c7b64c6ed22f5fec62b676ced1 was observed by OffSeq Mirage honeypot sensors on August 8, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash can be used as an indicator of compromise to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash ca2af697388746b2381dc7c4e857ffcec86223ea4618de4583437380050d7770 was observed by OffSeq Mirage honeypot sensors on 2026-08-08. The file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE). This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 41973e5dc419ef5d31ba3c0b984ae22d80dddd15d3bf65696e7e0c919134430f was observed twice in attacker activity on August 8, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This file hash serves as an indicator of compromise (IOC) for detection and response efforts.
A malicious file identified by the SHA-256 hash f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36 was observed 182 times in attacker activity between August 7 and August 29, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Argentina, Brazil, Canada, China, Indonesia, India, Italy, and Jordan. The hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise. No known exploits in the wild or vendor patches are applicable.
A malicious file identified by the SHA-256 hash 848f1546a84dd92cce3c1463e3e964698533d93d6ea7be00e000db5efbb1d2f4 was observed by OffSeq Mirage honeypot sensors eight times between August 6 and August 11, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Chile (CL) and China (CN). There is no known exploit in the wild or vendor patch information available. Organizations are advised to match this hash against files in their environment and threat intelligence feeds.
A malicious file identified by the SHA-256 hash f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6c was observed by OffSeq Mirage honeypot sensors on August 6, 2026. This file was detected six times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Ethiopia, India, and Turkey. There is no known exploit in the wild or vendor patch information associated with this indicator. Organizations are advised to match this hash against files in their environment and security feeds.
A malicious file identified by the SHA-256 hash e4e6d77040f6a91d42292fe7b8fbf9e6ca5722c940097e21a345d03b522af43d was observed 95 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash ee86d4b3017ccb464b3d27332ceed33de1a9e3836e2cf55adced642d210bef7f was observed by OffSeq Mirage honeypot sensors on 2026-08-04. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Israel. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools. No known exploits or threat actors are currently linked to this indicator.