IndicatorPublished 2 Jul 2026

Malicious SHA-256 file hash 7e9d7dd37751… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-02..2026-07-02, 2×

7e9d7dd37751686dc39a23a7f5f2012c3075e1a1f7fa61712887c7617439ecc0

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer and execution of harmful payloads such as droppers, web shells, miners, or post-exploitation tools. This can lead to unauthorized access, persistence, resource abuse, or further exploitation within affected environments. However, there is no evidence of widespread exploitation or known active campaigns beyond the observed honeypot detections.

Defensive guidance

Organizations should use this SHA-256 hash to scan their environments, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to identify and remove the malicious file if present. Continuous monitoring for ingress tool transfer activity (T1105) is recommended to detect similar threats.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Jul 2026, 06:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats