A malicious file identified by the SHA-256 hash 73850adc8e9319594baa05b5419dec3a1ccb32fe40beb55fe5647b017ef73df2 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. This file is associated with CVE-2026-109618 and linked to the ATT&CK technique T1105 (Ingress Tool Transfer). The file represents a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacker activity. The threat was observed originating from attacker infrastructure in Lithuania (LT).
A malicious file identified by the SHA-256 hash 9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4 was observed by OffSeq Mirage honeypot sensors on November 2, 2026. This file was detected twice in attacker activity originating from infrastructure in France. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file is likely a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 2ddf902d0e9c4d8f28598df149c4ad3fee4d966b5c2b1e8eff5cb2677ddb3130 was observed twice in attacker activity on November 2, 2026. The attack involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools into a target environment. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator should be matched against files in environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 5cb46c2be1604c22a410de06f851cf0e2e80c7eef3583f92a1080fbab1c224dc was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was seen 12 times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 5349666da6dc9f096b7192658b07d80ddf5a77fecd8f8075f1595c23038a7adb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a6238b62f373d3ddbad8a034aa94debb0f4b6b9642da6f3120a99565e97ece1d was observed twice in attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A malicious file identified by the SHA-256 hash ba1f9d2e31f7d4aa9b56d39c6e2d5090fff1645b31b8a26dc5e50da22aa244bf was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool delivered or staged during the attack. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious file in environments through matching with endpoint detection and response (EDR), antivirus (AV), or threat intelligence feeds.
A malicious file identified by the SHA-256 hash 2807c004092b2c84f1d3e9cefc5277d54a42fadce97788e02e8098fd7ff8ba86 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 1aa17abe3be18c408e72a38290f3ffb8a6d96bf4862fed9d9e4209822f5039f5 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was involved in attacker activity using technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b6833206a0c545d501275e8fd91955befd900adfdf1a4bfb0c0759bf3606e9bb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash d8e47c699b68eac208cb265deb82902f613cee0391549f14f94f1c3305b6fb93 was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This hash can be used to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash a8a4c7376a27c9b5ad8cdc6a0fd970b77e28843b2a0349f4e1b49ad5bdcdf6d7 was observed by OffSeq Mirage honeypot sensors during attacker activity between November 2 and November 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in Romania. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was seen twice in the wild during this period. There is no information about active exploitation or known threat actors. No affected software versions are specified.
A malicious file identified by the SHA-256 hash fe06eb908f0b5c042ea623f4e30e822d498b1b410862528b9df59ca52a57e837 was observed by OffSeq Mirage honeypot sensors on 2026-10-30. This file was seen four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Bulgaria. The file hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d. This file was observed three times on October 29, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool delivered during the attack. The attacker infrastructure was located in Romania (RO). There is no information about known exploits in the wild or affected software versions.
A malicious file identified by the SHA-256 hash f60c2c8b098025a65c50bc7eb3f2d92a5bd4a6f0915cbb921c0f275dbea410e1 was observed twice on October 29, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure located in the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash 5bb52bd682510c1fdc91025512a92c0e2323c885664e65ad32f0fbb426940469 was observed by OffSeq Mirage honeypot sensors on 2026-10-26. The file was detected four times during attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The malicious activity was traced to attacker infrastructure located in PS. Organizations are advised to match this hash against their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash a863e21577e54cd763729803a621804da4b5030afa35bcf879ea3b3413488a66 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-10-26. This file is associated with CVE-2026-109618 and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. The activity was traced back to attacker infrastructure in PS. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125 was observed by OffSeq Mirage honeypot sensors on 2026-10-25. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The activity was seen originating from attacker infrastructure in KP. No known exploits in the wild or specific affected software versions are reported.
A malicious file identified by the SHA-256 hash d3e15a3cb34e3615b12e148369ac3bcebd5566760ebbf569ec59d02505420a74 was observed three times on October 24, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Poland. This indicator should be matched against files in security environments and threat intelligence feeds for detection purposes.