IndicatorPublished 07/18/2026Updated 07/21/2026
Malicious SHA-256 file hash 63952f1d3a85… (OffSeq Mirage)
Source OffSeq Mirage
Description
OffSeq Mirage honeypot sensors observed this SHA-256 file hash 64 time(s) in attacker activity between 2026-07-18 and 2026-07-21. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in BR, CN, ID, IN, IR, IT, PK, TH. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.
Indicators of compromise
Hashes 1
- 63952f1d3a85ae646317fd592027e258e1dbbba8c7bd4822e2551b9f0a4f8315OffSeq Mirage — a malicious file, observed 2026-07-18..2026-07-21, 64×