Malicious SHA-256 file hash 5349666da6dc… (OffSeq Mirage)
Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)
Indicators of compromise
Hashes 1
OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×
Description
A malicious file identified by the SHA-256 hash 5349666da6dc9f096b7192658b07d80ddf5a77fecd8f8075f1595c23038a7adb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.