IndicatorPublished 1 Jul 2026Updated 10 Oct 2026

Malicious SHA-256 file hash 94f2e4d8d443… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-01..2026-07-09, 2×

94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer or staging of malicious payloads such as droppers, web shells, miners, or post-exploitation tools. Detection of this file in an environment suggests attacker activity and possible unauthorized access or persistence. There is no direct vulnerability or exploit associated with this hash; rather, it is a forensic indicator of malicious activity.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR) systems, antivirus (AV) solutions, and threat intelligence feeds to detect and respond to potential infections. Monitoring for T1105 ingress tool transfer activity and blocking or quarantining files matching this hash is recommended.

Summary

OffSeq Mirage detected a malicious file hash (SHA-256: 94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00) involved in attacker activity observed twice between July 1 and July 9, 2026. The activity involved the T1105 technique, which is used for ingress tool transfer, suggesting the file is part of a malicious payload delivery or staging process. The threat intelligence does not specify a particular vulnerability or affected software versions but identifies the file as malicious and linked to attacker infrastructure in the US. No known exploits in the wild are reported for this indicator. This is an indicator of compromise useful for detection and response.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 9 Jul 2026, 11:02 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats