IndicatorPublished 31 Aug 2026Updated 29 Oct 2026

Malicious SHA-256 file hash d70f917e3581… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-08-31..2026-10-29, 2×

d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141

Description

A malicious file identified by the SHA-256 hash d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 was observed by OffSeq Mirage honeypot sensors during attacker activity between August 31, 2026, and October 29, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany. This hash serves as an indicator of compromise (IOC) for detection and response purposes.

Impact

The malicious file is associated with attacker activity involving the transfer of potentially harmful payloads such as droppers, web shells, miners, or post-exploitation tools. This indicates a risk of unauthorized code execution, persistence, or resource abuse if the file is present in an environment. However, no direct evidence of exploitation or active threat actor campaigns is reported.

Defensive guidance

Match the provided SHA-256 hash against files in your environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect presence of this malicious payload. Use this IOC to enhance detection and response capabilities.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:55 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats