IndicatorPublished 28 Jun 2026Updated 9 Aug 2026

Malicious SHA-256 file hash a9b1c85a7bd7… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-06-28..2026-06-29, 2×

a9b1c85a7bd78dd1112ecc75c9070ea8c53078831a17aa09ebeb287fe6e21b72

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 10 time(s) in attacker activity between 2026-06-28 and 2026-07-07. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in KR, CN. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential attacker activity involving the transfer of a harmful payload into a target environment. The payload type may include droppers, web shells, miners, or post-exploitation tools, which can facilitate unauthorized access, persistence, or resource abuse. However, no confirmed exploitation or widespread attacks using this file hash have been reported to date.

Defensive guidance

Security teams should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR) systems, antivirus (AV) solutions, and threat intelligence feeds to identify potential infections. If detected, standard incident response procedures should be followed to contain and remediate the threat.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 29 Jun 2026, 11:51 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats