A malicious file identified by the SHA-256 hash 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected five times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Norway. There is no information about known exploits in the wild or affected software versions. This is an indicator of compromise to be matched against files in environments and security tools.
A malicious file identified by the SHA-256 hash 6ef4fcf12a66fb4f240fd1357a3e4c519f8f28e82146209168ce145d2b762991 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. There is no information about active exploitation or known threat actors linked to this file. No affected software versions or patches are specified.
A malicious file identified by the SHA-256 hash 578bfa5ed439f9d83b8197f4cf55c893c9f6447929c8df72c696fa9177213d3f was observed twice on July 12, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits in the wild or affected software versions are reported. This indicator can be used to detect the presence of this malicious file in environments via file hash matching in EDR, AV, or threat intelligence feeds.
A malicious file identified by the SHA-256 hash aa111ee167785d363211b52af0cc02fae9c7e42968bff53d4a27db76929b7cf4 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in the United States. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available. Organizations are advised to check this hash against their environments and security tools for detection.
A malicious file identified by the SHA-256 hash 2985d2ce196b9d6fb2c37d601a9b13a936b90ba84c2f16dbd06b53c2a7aecb49 was observed by OffSeq Mirage honeypot sensors on July 12, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. Organizations are advised to match this hash against files in their environments and threat intelligence feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a2328347ae28c0fd922ef7d919d0692444d5072cf58f32522896551fc622019a was observed by OffSeq Mirage honeypot sensors during attacker activity on July 12, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in the United States. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this hash in their environments and security tools. No known exploits or threat actors are currently linked to this indicator.
A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.
A malicious file identified by the SHA-256 hash 0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7 was observed 167 times in attacker activity between July 12 and August 1, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Bulgaria, France, Great Britain, Hong Kong, and the United States. This file hash serves as an indicator of compromise (IOC) for detection and response purposes.
A malicious file identified by the SHA-256 hash 1dee0949441736015e60e2f4589a8855dbd19fcf9387946cf20ef2fed246ad7a was observed 409 times in attacker activity between July 11, 2026, and August 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Great Britain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 9f44bf644db7bdaee5ffdbe66b5db29861fe10aa39ce3ed1738b1bc15a5ce6da was observed by OffSeq Mirage honeypot sensors during attacker activity between July 11 and July 12, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in China, India, Pakistan, and Sweden. This indicator is intended for matching against files in environments and security feeds to detect potential malicious activity.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-09 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-09 and 2026-07-10. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in TZ, TH. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-09 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-09 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-09 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 24 time(s) in attacker activity between 2026-07-07 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 53 time(s) in attacker activity between 2026-07-03 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in GB. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.