IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash 5cb46c2be160… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 12×

5cb46c2be1604c22a410de06f851cf0e2e80c7eef3583f92a1080fbab1c224dc

Description

A malicious file identified by the SHA-256 hash 5cb46c2be1604c22a410de06f851cf0e2e80c7eef3583f92a1080fbab1c224dc was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was seen 12 times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.

Impact

The presence of this malicious file indicates potential compromise involving the transfer of a harmful payload into the environment. The payload could enable further malicious actions such as persistence, data theft, or resource abuse. However, no confirmed exploitation or active campaigns are reported at this time.

Defensive guidance

Organizations should use the provided SHA-256 hash to scan their environments, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to identify and remediate any instances of this malicious file. Monitoring for T1105 technique activity and blocking known attacker infrastructure IPs may also help reduce risk.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 17:15 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats