IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash a6238b62f373… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

a6238b62f373d3ddbad8a034aa94debb0f4b6b9642da6f3120a99565e97ece1d

Description

A malicious file identified by the SHA-256 hash a6238b62f373d3ddbad8a034aa94debb0f4b6b9642da6f3120a99565e97ece1d was observed twice in attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.

Impact

The malicious file identified by this hash is associated with attacker activity involving ingress tool transfer, which can facilitate the delivery of various malicious payloads including droppers, web shells, miners, or post-exploitation tools. This can lead to unauthorized access, persistence, resource abuse, or further compromise of affected systems. However, no direct evidence of exploitation in the wild or active campaigns is reported.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environments and security telemetry such as EDR and antivirus tools. Blocking or quarantining files matching this hash and investigating related activity is recommended to mitigate potential compromise.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 16:47 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats