IndicatorPublished 2 Jul 2026

Malicious SHA-256 file hash 768f55d013d5… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-02..2026-07-02, 2×

768f55d013d50dfe4f4de722243bb68774dc26117c3f133549a61fbd1bbec257

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer and execution of harmful payloads within a target environment. The impact depends on the payload type (dropper, web shell, miner, or post-exploitation tool) but may include unauthorized access, persistence, resource abuse, or further exploitation. No active exploitation in the wild has been reported, and no specific vulnerabilities are described.

Defensive guidance

Security teams should match this SHA-256 hash against files in their environments and update EDR/AV and threat intelligence feeds accordingly to detect and block this malicious payload. Monitoring for the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) may help identify related attacker activity. No further vendor guidance or fixes are provided.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Jul 2026, 06:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats