Malicious SHA-256 file hash 3f3bf218089d… (OffSeq Mirage)

A malicious file identified by the SHA-256 hash 3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 was observed by OffSeq Mirage honeypot sensors twice between August 31, 2026, and October 29, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.

• mirage.offseq.com (opens in a new tab)

• Malicious SHA-256 file hash f0aa83bbbd2c… (OffSeq Mirage)Indicator2026-08-31
• Malicious SHA-256 file hash d70f917e3581… (OffSeq Mirage)Indicator2026-08-31
• Malicious SHA-256 file hash d1cac82f44b5… (OffSeq Mirage)Indicator2026-08-31
• Malicious SHA-256 file hash 8e1a67a5c03b… (OffSeq Mirage)Indicator2026-08-31
• Malicious SHA-256 file hash 3f3a11bafabb… (OffSeq Mirage)Indicator2026-08-31