IndicatorPublished 2 Nov 2026

Malicious SHA-256 file hash d8e47c699b68… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-11-02..2026-11-02, 2×

d8e47c699b68eac208cb265deb82902f613cee0391549f14f94f1c3305b6fb93

Description

A malicious file identified by the SHA-256 hash d8e47c699b68eac208cb265deb82902f613cee0391549f14f94f1c3305b6fb93 was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This hash can be used to detect the presence of this malicious file in environments and security tools.

Impact

The presence of this malicious file indicates attacker activity involving the transfer of potentially harmful payloads such as droppers, web shells, miners, or post-exploitation tools. This could lead to unauthorized access, persistence, or resource abuse if the file is executed within a target environment. However, no direct exploit or active widespread attack is confirmed.

Defensive guidance

Match the provided SHA-256 hash against files in your environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to identify any presence of this malicious payload. Use this hash to enhance detection and response capabilities.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 16:01 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats