Malicious SHA-256 file hash e1e275cf672d… (OffSeq Mirage)

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 3 time(s) in attacker activity between 2026-11-14 and 2026-11-14. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in NL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

• mirage.offseq.com (opens in a new tab)

• Malicious SHA-256 file hash af3e4ef0c187… (OffSeq Mirage)Indicator2026-11-14
• Malicious SHA-256 file hash ad4ec186ede7… (OffSeq Mirage)Indicator2026-11-14
• Malicious SHA-256 file hash 8287d65844b6… (OffSeq Mirage)Indicator2026-11-14
• Malicious SHA-256 file hash 7905c4ad4267… (OffSeq Mirage)Indicator2026-11-14
• Malicious SHA-256 file hash 6fbdd13040b4… (OffSeq Mirage)Indicator2026-11-14