IndicatorPublished 1 Jul 2026

Malicious SHA-256 file hash 62cca9ae3c54… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-01..2026-07-01, 2×

62cca9ae3c547f1119bb500cc809362240215f11eb1851fc60974e1d5de4b847

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in ES. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file indicates potential compromise or attempted compromise involving the transfer of malicious tools or payloads into a target environment. If executed, the payload could enable attackers to establish persistence, conduct further exploitation, or perform unauthorized activities. However, no direct exploit or vulnerability is described, and no known active exploitation beyond the observed honeypot detections is reported.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environments and security telemetry such as EDR and antivirus solutions. Detection and removal of this file, if present, will mitigate risk. Monitoring for related attacker activity and applying standard incident response procedures upon detection is recommended.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 1 Jul 2026, 06:51 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats