IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash 1aa17abe3be1… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

1aa17abe3be18c408e72a38290f3ffb8a6d96bf4862fed9d9e4209822f5039f5

Description

A malicious file identified by the SHA-256 hash 1aa17abe3be18c408e72a38290f3ffb8a6d96bf4862fed9d9e4209822f5039f5 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was involved in attacker activity using technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer of malicious tools or payloads into a target environment. Such payloads can facilitate unauthorized access, persistence, or resource abuse. However, no direct evidence of exploitation or active attacks beyond detection is provided. The impact depends on the payload type and deployment context but generally represents a threat to system integrity and security.

Defensive guidance

No specific patch or fix is applicable as this is an indicator of compromise rather than a software vulnerability. Organizations should use this SHA-256 hash to scan their environments, endpoint detection and response (EDR) systems, antivirus (AV) solutions, and threat intelligence feeds to identify and remediate any presence of the malicious file. Monitoring for T1105 ingress tool transfer activity and blocking connections from the identified attacker infrastructure in France may also help reduce risk.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 16:44 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats