IndicatorPublished 9 Nov 2026

Malicious SHA-256 file hash 8f4ebfb87e11… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-09..2026-11-09, 2×

8f4ebfb87e11d0829e458ddc0f795fc2f1800dd16c7f705cf05fbd95b7bceab9

Description

A malicious file identified by the SHA-256 hash 8f4ebfb87e11d0829e458ddc0f795fc2f1800dd16c7f705cf05fbd95b7bceab9 was observed twice on November 9, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure in Finland. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.

Impact

The malicious file identified by the hash is associated with attacker activity involving tool transfer, which may facilitate further compromise such as payload execution or persistence. The specific payload type is not confirmed but may include droppers, web shells, miners, or post-exploitation tools. There is no evidence of known exploits in the wild beyond the observed attacker activity. The presence of this file in an environment indicates potential compromise or attempted intrusion.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect and remediate any presence of this malicious payload. Monitoring for this indicator and blocking or removing matching files is recommended.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 9 Nov 2026, 20:48 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats