IndicatorPublished 2 Nov 2026Updated 10 Nov 2026

Malicious SHA-256 file hash 080892ec55b1… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-10, 2×

080892ec55b13d0b0c887264f47d53e3a2e9654d086a5fff267edca439ef7200

Description

A malicious file identified by the SHA-256 hash 080892ec55b13d0b0c887264f47d53e3a2e9654d086a5fff267edca439ef7200 was observed in attacker activity between November 2 and November 10, 2026. The file was associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to transfer tools or payloads during an attack. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The activity was linked to attacker infrastructure located in Romania (RO). Organizations are advised to check this hash against their environments and security tools to detect potential compromise.

Impact

The malicious file associated with this hash represents a threat as it is used in attacker operations to transfer and deploy harmful payloads within victim environments. The presence of such a file could lead to unauthorized access, persistence, resource abuse, or further compromise depending on the payload type. However, no confirmed exploitation or active widespread attacks are reported in this data.

Defensive guidance

No specific patch or fix is applicable as this is an indicator of compromise rather than a software vulnerability. Organizations should use this hash to scan their environments and update endpoint detection and response (EDR) and antivirus (AV) tools and threat intelligence feeds to detect and block this malicious file. Monitoring for the presence of this hash and related attacker activity is recommended.

Summary

OffSeq Mirage honeypot sensors detected a specific malicious file hash twice during a defined period in November 2026. The file is linked to the T1105 technique, which involves transferring tools or payloads into a target environment. The hash fingerprints a malicious payload that may serve various attacker purposes such as dropping additional malware, establishing web shells, mining cryptocurrency, or conducting post-exploitation activities. The attacker infrastructure was identified in Romania. This indicator is intended for use in threat intelligence and detection efforts.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 10 Nov 2026, 08:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats