A malicious file identified by the SHA-256 hash e144da3f5a982d5ed3a6c4edfa98bbfdc83fca9f67791f83123801061dc12eb4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 25 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 74ef10b3118313e6f1a26b71b60b5b978f193c796c1ec24a57cf2832334ff8c7 was observed multiple times in attacker activity between July 25 and July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash d1515ff3e467c83dff345353f38acc27ac1788964a7b5a320fb2f3b1c0eb63a6 was observed by OffSeq Mirage honeypot sensors 80 times between July 25 and July 27, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Bulgaria (BG). Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file originated from attacker infrastructure located in MU. This indicator can be used to detect or block the associated malicious payload in affected environments.
A malicious file identified by the SHA-256 hash b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. No known exploits in the wild or specific affected software versions are identified. The indicator is intended for matching against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 9ab6e598d685e617ad0194d390257dc2061124a5b44ba003b8caa7d6c40516d6 was observed by OffSeq Mirage honeypot sensors on July 25, 2026. The file was detected twice in attacker activity originating from infrastructure in Mauritius (MU). The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There are no known exploits in the wild associated with this file hash, and no affected software versions are specified.
The URL sbc.questblue.com was observed in the wild as an attacker callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors on July 24, 2026, with two occurrences noted. The technique involved is T1071, which relates to the use of application layer protocols for command and control. The attacker infrastructure was identified as originating from Finland (FI).
A malicious file identified by the SHA-256 hash 01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9 was observed by OffSeq Mirage honeypot sensors four times between July 23 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no information on active exploitation in the wild or known threat actors associated with this hash. No affected software versions or patches are applicable as this is an indicator of compromise rather than a software vulnerability.
A malicious file identified by the SHA-256 hash 9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034 was observed by OffSeq Mirage honeypot sensors 10 times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is provided.
A malicious file identified by the SHA-256 hash cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b was observed by OffSeq Mirage honeypot sensors five times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was seen originating from attacker infrastructure located in MU. No known exploits in the wild or vendor patches are indicated. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a64aadbc9c68fad12433ca75b2ded3c70db9a73ada83c7abf4882b04cd91f500 was observed by OffSeq Mirage honeypot sensors six times between July 23 and July 26, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was transferred from attacker infrastructure. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. No known exploits or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash 89e89ac00b0c3adcf25435c19dfc828d87e5bb311c9a858f56e8463b14b3e254 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. No specific affected software versions or exploits in the wild are reported. The file hash serves as an indicator of compromise for detection and response efforts.
A malicious file identified by the SHA-256 hash 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Germany. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits in the wild or affected software versions are identified. The indicator is intended for matching against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash e2bc7981064d3c9ed898a0f62d659fdc2fc9646dee47a9ca92b9b28b96c27a3b was observed twice on July 23, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No known exploits in the wild or affected software versions are identified. The threat is categorized as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash b3232d2cd03b051c59aef952ecfea3358c172351a27a989df31720395c3cbb4a was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity originating from infrastructure in Germany. The observed technique corresponds to T1105 (Ingress Tool Transfer), indicating the file is likely a payload such as a dropper, web shell, miner, or post-exploitation tool used in attacks. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 3edfb02c0e6b2fe4894425cd0d4d2507f7cb11e0958674422729366a0d885c7e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect and block this specific malicious file in security environments.
A malicious file identified by the SHA-256 hash efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE).
A malicious file identified by the SHA-256 hash dc2416a0d219b6a417f4fb1dfdcabd4e1326a13f772781be2769921291eeba7d was observed by OffSeq Mirage honeypot sensors on 2026-07-22. This file was seen 10 times in attacker activity originating from infrastructure in Great Britain. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file is likely a payload used for malicious purposes such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or patches are associated with this indicator. No known exploits in the wild or threat actors are linked to this hash at this time.
A malicious file identified by the SHA-256 hash d079a02683cde96446dae0624843f3a0ce1641a26a75083b9aef4cc8b892343a was observed 45 times in attacker activity between July 22 and July 30, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in multiple countries including Argentina, Brazil, China, India, Jordan, Pakistan, Russia, and Sweden. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. The indicator is intended for matching against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. The file was involved in attacker activity using the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. The file was observed twice during the specified date. There is no known exploit in the wild associated with this hash, and no affected software versions are identified.