IndicatorPublished 2 Jul 2026

Malicious SHA-256 file hash 6f87e28bf658… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-02..2026-07-02, 2×

6f87e28bf658c79133f37b3f9eea93746ebd6df8beed4156eeaab78670b8a35d

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file indicates that an attacker has staged or delivered a potentially harmful payload within a target environment. The payload could enable further malicious activities such as persistence, data theft, or resource abuse. However, no direct information about exploitation success or widespread impact is provided.

Defensive guidance

No specific patch or remediation is available or indicated for this file hash. Organizations should use this SHA-256 hash as an indicator of compromise in their endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect and block this malicious payload. Regularly updating detection signatures and monitoring for this hash in the environment is recommended.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Jul 2026, 06:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats