IndicatorPublished 24 Jun 2026Updated 2 Aug 2026

Malicious SHA-256 file hash 0c99433c7d43… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-06-24..2026-06-25, 2×

0c99433c7d433d65ab890dcee20b330f262379d532bc76f91e18f09ecfa5fb54

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 6 time(s) in attacker activity between 2026-06-24 and 2026-07-04. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in IT, KR, IR. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash in an environment indicates potential compromise involving the transfer and staging of harmful software components such as droppers, web shells, miners, or post-exploitation tools. While the file has been observed multiple times in attacker activity, there is no evidence of widespread exploitation or active targeting campaigns. Detection of this file suggests an attacker may have established or attempted to establish persistence or further control within the environment.

Defensive guidance

Organizations should use the provided SHA-256 hash to scan their environments, including endpoint detection and response (EDR) and antivirus (AV) systems, to identify any presence of this malicious file. Incorporate this indicator into threat intelligence feeds and monitoring tools to detect potential ingress tool transfer activity. If detected, follow standard incident response procedures to investigate and remediate the compromise.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Jul 2026, 20:51 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats