IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash 58c8e25de53f… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd

Description

A malicious file identified by the SHA-256 hash 58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer and execution of harmful payloads such as droppers, web shells, miners, or post-exploitation tools. This can lead to unauthorized access, persistence, resource abuse, or further exploitation within affected systems. However, no confirmed exploitation or active campaigns are reported beyond the observed honeypot detections.

Defensive guidance

Security teams should match the provided SHA-256 hash against files in their environments and security telemetry (EDR/AV/threat intelligence feeds) to detect and respond to any presence of this malicious payload. Blocking or quarantining files matching this hash and investigating related activity is recommended.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 16:01 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats