IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash 9ed487498235… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4

Description

A malicious file identified by the SHA-256 hash 9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4 was observed by OffSeq Mirage honeypot sensors on November 2, 2026. This file was detected twice in attacker activity originating from infrastructure in France. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file is likely a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.

Impact

The presence of this malicious file hash indicates potential attacker activity involving the transfer of malicious payloads into victim environments. The specific impact depends on the payload type (e.g., dropper, web shell, miner, post-exploitation tool), but no direct exploit or active widespread exploitation is confirmed. Detection of this hash in an environment suggests compromise or attempted compromise requiring investigation.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environments and security tools such as EDR and antivirus solutions. Monitoring for this indicator can help detect and respond to attacker activity involving ingress tool transfer. No vendor advisory or official remediation is provided.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 17:44 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats