A malicious file identified by the SHA-256 hash 980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc was observed twice in attacker activity on July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator should be matched against files in environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019 was observed twice on July 21, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 50cffb0f65d31b38f5b222955d92879a3e102d0a0d9a3625ed87fb7834fab210 was observed by OffSeq Mirage honeypot sensors on July 21, 2026. This file was seen twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) and originated from attacker infrastructure in Great Britain. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific software versions are affected, and no known exploits or threat actors are linked to this indicator. The observation serves as an indicator of compromise for detection and response purposes.
A malicious file identified by the SHA-256 hash 7eeb49a12710a14273958e8a5c0594987416ce88d46e57f5c28906d9ff892c1d was observed twice on July 20, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in the United States. No known exploits or threat actors are currently linked to this indicator, and no affected software versions are specified.
The URL https://psychologylifecentre.com/bins/unkillbot_x86_64 was observed in attacker activity on 2026-07-20 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring attacker tools or payloads. The URL was seen four times and linked to attacker infrastructure located in the United States. It is recommended to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash d8a8cea14b12aa75047979f929bdf10b9003884580398c3c13d2b4fb04209410 was observed by OffSeq Mirage honeypot sensors on July 20, 2026. This file was detected 10 times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland and Vietnam. This indicator can be used to detect the presence of this specific malicious file in environments and security tools.
The URL chinamobile.com was observed as an attacker callback or command-and-control (C2) endpoint in the wild between 2026-07-20 and 2026-08-11. This activity was detected by OffSeq Mirage honeypot sensors 32 times and involved the use of the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in France. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e was observed by OffSeq Mirage honeypot sensors five times between July 19 and July 30, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this specific malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a531f3e6224862abd00091c4955d535ace2bb886df53bdcd59c3a32b44c93629 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and may represent a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching against endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash e981d296a7034bc03a3a84185b5ac07d26afc01004f55cafadfaad1c42d70f40 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 19 and July 22, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.
A malicious file identified by the SHA-256 hash a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check for this file hash in their environments and security telemetry to detect potential compromise.
A malicious file identified by the SHA-256 hash 8ec920a35a7c6dd60e4aeb3b1ed09cd344f4c5191d4314a05ce72bf757377c86 was observed in attacker activity between July 19 and July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was detected twice by OffSeq Mirage honeypot sensors. No known exploits in the wild or affected software versions are reported.
A malicious file identified by the SHA-256 hash f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d was observed by OffSeq Mirage honeypot sensors during attacker activity from July 19 to July 22, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. There is no information about known exploits in the wild or affected software versions. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
An attacker URL https://psychologylifecentre.com/bins/$b was observed in the wild by OffSeq Mirage honeypot sensors 38 times between July 19 and July 21, 2026. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified in the Philippines and the United States. Defenders are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b was observed by OffSeq Mirage honeypot sensors on July 19, 2026. This file was detected 11 times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacks originating from infrastructure in the Philippines. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.
A URL associated with attacker activity was observed multiple times in the wild on July 19, 2026. The URL, hosted on sistemasyusa.icu, was linked to an attacker payload involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This URL was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from the Philippines. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash d6bb2dc0431405c4158cc15ed0171fd3a53986bc79149ada27dec7b1edcf5b14 was observed by OffSeq Mirage honeypot sensors on July 19, 2026. The file was seen six times in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Brazil. There is no information about known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d was observed by OffSeq Mirage honeypot sensors during attacker activity between July 18 and July 19, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in the Netherlands and the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise. No known exploits in the wild have been reported for this file. No affected software versions or patches are applicable as this is an indicator of compromise rather than a vulnerability.
A malicious file identified by the SHA-256 hash 63952f1d3a85ae646317fd592027e258e1dbbba8c7bd4822e2551b9f0a4f8315 was observed 64 times in attacker activity between July 18 and July 21, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in multiple countries including Brazil, China, Indonesia, India, Iran, Italy, Pakistan, and Thailand. This indicator should be matched against files in environments and security tools to detect potential compromise.
A URL associated with attacker activity was observed multiple times on July 18, 2026. The URL, https://sistemasyusa.icu/admin/productimages/b, was detected by OffSeq Mirage honeypot sensors and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as originating from the Philippines. This URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software vulnerability or exploit code is detailed.