Malicious SHA-256 file hash 3f3a11bafabb… (OffSeq Mirage)
Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)
Indicators of compromise
Hashes 1
OffSeq Mirage — a malicious file, observed 2026-08-31..2026-10-29, 2×
Description
A malicious file identified by the SHA-256 hash 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.