IndicatorPublished 31 Aug 2026Updated 29 Oct 2026

Malicious SHA-256 file hash 1e70b6347277… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-08-31..2026-10-29, 2×

1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d

Description

A malicious file identified by the SHA-256 hash 1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) to detect this specific malicious payload in environments and security tools.

Impact

The malicious file identified by the hash is associated with attacker activity involving the transfer of potentially harmful payloads such as droppers, web shells, miners, or post-exploitation tools. Such payloads can facilitate unauthorized access, persistence, resource abuse, or further compromise of affected systems. However, no specific exploitation or active widespread impact is confirmed beyond the observed attacker activity.

Defensive guidance

Use the provided SHA-256 hash to match against files in your environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect and block this malicious payload. Regularly update threat intelligence sources and security tools to include this IOC for proactive detection.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 29 Oct 2026, 15:07 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats