Malicious SHA-256 file hash ba1f9d2e31f7… (OffSeq Mirage)
Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)
Indicators of compromise
Hashes 1
OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×
Description
A malicious file identified by the SHA-256 hash ba1f9d2e31f7d4aa9b56d39c6e2d5090fff1645b31b8a26dc5e50da22aa244bf was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool delivered or staged during the attack. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious file in environments through matching with endpoint detection and response (EDR), antivirus (AV), or threat intelligence feeds.