A malicious file identified by the SHA-256 hash dc8586402cbd86a2593fab196f3ced051326c21120144264492c07c5d91f2cfa was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG).
A malicious file identified by the SHA-256 hash 5b694a7351bb12f07ad0d3bde910eacd5debeccdfcdb52081317e4da944cb730 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in MU. This hash fingerprints a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. No direct exploit or patch information is available for this indicator. Organizations should match this hash against their environments and security tools to detect potential presence.
A malicious file identified by the SHA-256 hash 752f690e3926fc04088edfb0cb06f679f4a2e44f88e7d0d9aa16d3ebf8db99cf was observed by OffSeq Mirage honeypot sensors on 2026-07-26. The file was detected three times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in Bulgaria. This hash corresponds to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. No specific affected software versions or CVE identifiers are associated with this indicator. There is no known exploit in the wild linked to this file hash at this time.
A malicious file identified by the SHA-256 hash c43795d89b5cbde3f1b16fea18fb586e024a23ac4e2fbb48a0a18dd851a45876 was observed twice on 2026-07-26 by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that may be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Bulgaria (BG). No known exploits in the wild or vendor patches are reported. Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash e144da3f5a982d5ed3a6c4edfa98bbfdc83fca9f67791f83123801061dc12eb4 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 25 and July 26, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 74ef10b3118313e6f1a26b71b60b5b978f193c796c1ec24a57cf2832334ff8c7 was observed multiple times in attacker activity between July 25 and July 26, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Bulgaria. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and threat intelligence feeds. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash d1515ff3e467c83dff345353f38acc27ac1788964a7b5a320fb2f3b1c0eb63a6 was observed by OffSeq Mirage honeypot sensors 80 times between July 25 and July 27, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Bulgaria (BG). Defenders are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash ce7568afc34c67e286c731c882d03a9b2a8401b04fbd4613f5bcb98f4b09a277 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file originated from attacker infrastructure located in MU. This indicator can be used to detect or block the associated malicious payload in affected environments.
A malicious file identified by the SHA-256 hash b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64 was observed by OffSeq Mirage honeypot sensors six times between July 25 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. No known exploits in the wild or specific affected software versions are identified. The indicator is intended for matching against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 9ab6e598d685e617ad0194d390257dc2061124a5b44ba003b8caa7d6c40516d6 was observed by OffSeq Mirage honeypot sensors on July 25, 2026. The file was detected twice in attacker activity originating from infrastructure in Mauritius (MU). The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. There are no known exploits in the wild associated with this file hash, and no affected software versions are specified.
The URL sbc.questblue.com was observed in the wild as an attacker callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors on July 24, 2026, with two occurrences noted. The technique involved is T1071, which relates to the use of application layer protocols for command and control. The attacker infrastructure was identified as originating from Finland (FI).
A malicious file identified by the SHA-256 hash 01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9 was observed by OffSeq Mirage honeypot sensors four times between July 23 and July 28, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in MU. There is no information on active exploitation in the wild or known threat actors associated with this hash. No affected software versions or patches are applicable as this is an indicator of compromise rather than a software vulnerability.
A malicious file identified by the SHA-256 hash 9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034 was observed by OffSeq Mirage honeypot sensors 10 times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was observed originating from attacker infrastructure located in MU. There is no indication of known exploits in the wild or specific affected software versions. No patch or remediation information is provided.
A malicious file identified by the SHA-256 hash cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b was observed by OffSeq Mirage honeypot sensors five times between July 23 and July 28, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat was seen originating from attacker infrastructure located in MU. No known exploits in the wild or vendor patches are indicated. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a64aadbc9c68fad12433ca75b2ded3c70db9a73ada83c7abf4882b04cd91f500 was observed by OffSeq Mirage honeypot sensors six times between July 23 and July 26, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was transferred from attacker infrastructure. The file is associated with malicious payloads such as droppers, web shells, miners, or post-exploitation tools. No specific affected software versions or patches are identified. No known exploits or threat actors are linked to this indicator at this time.
A malicious file identified by the SHA-256 hash 89e89ac00b0c3adcf25435c19dfc828d87e5bb311c9a858f56e8463b14b3e254 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. This file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in MU. No specific affected software versions or exploits in the wild are reported. The file hash serves as an indicator of compromise for detection and response efforts.
A malicious file identified by the SHA-256 hash 63be5f38b520b3143732962a5f8fec1f9abd1f483dbc741ed324e58f955dd35e was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Germany. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. No known exploits in the wild or affected software versions are identified. The indicator is intended for matching against files in environments and security tools to detect potential compromise.