IndicatorPublished 2 Jul 2026

Malicious SHA-256 file hash d8389b3d979a… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-02..2026-07-02, 2×

d8389b3d979ac74751389b9cd146be0b3d0cfa4ca011f6c6d68589b1c47403bf

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-02 and 2026-07-02. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in US. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer of malicious payloads that could enable attackers to establish persistence, execute arbitrary code, or conduct post-exploitation activities. However, there are no known exploits in the wild directly associated with this hash, and no specific software vulnerabilities are implicated.

Defensive guidance

Security teams should use this SHA-256 hash to scan their environments, including endpoint detection and response (EDR) and antivirus (AV) tools, to identify and remove any matching malicious files. Incorporate this indicator into threat intelligence feeds and monitoring systems to detect related attacker activity. Follow standard incident response procedures if the file is found.

Summary

OffSeq Mirage detected a malicious file hash (SHA-256: d8389b3d979ac74751389b9cd146be0b3d0cfa4ca011f6c6d68589b1c47403bf) linked to attacker activity on 2026-07-02. The activity involved the T1105 technique, which is used for ingress tool transfer, suggesting the file was part of a staged or delivered payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was identified as being in the US. This is an indicator of compromise rather than a vulnerability or exploit with a patch. No known exploits or affected software versions are specified.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Jul 2026, 06:06 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats