IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash 2ddf902d0e9c… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

2ddf902d0e9c4d8f28598df149c4ad3fee4d966b5c2b1e8eff5cb2677ddb3130

Description

A malicious file identified by the SHA-256 hash 2ddf902d0e9c4d8f28598df149c4ad3fee4d966b5c2b1e8eff5cb2677ddb3130 was observed twice in attacker activity on November 2, 2026. The attack involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools into a target environment. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator should be matched against files in environments and security feeds to detect potential compromise.

Impact

The presence of this malicious file indicates potential unauthorized tool transfer into a target environment, which could facilitate further compromise such as persistence, data theft, or resource abuse. However, there is no evidence of widespread exploitation or active campaigns beyond the observed two instances. The exact impact depends on the payload type (dropper, web shell, miner, or post-exploitation tool) but generally represents a significant security risk if detected in an environment.

Defensive guidance

Use this SHA-256 hash as an indicator of compromise in endpoint detection and response (EDR) and antivirus (AV) tools to identify and block the malicious payload. Match this hash against files in your environment and threat intelligence feeds. Maintain updated detection capabilities and monitor for ingress tool transfer activity (T1105).

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 17:44 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats