IndicatorPublished 07/19/2026

Malicious SHA-256 file hash ee793426a461… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b was observed by OffSeq Mirage honeypot sensors on July 19, 2026. This file was detected 11 times during attacker activity and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file likely represents a malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacks originating from infrastructure in the Philippines. No specific software versions are affected, and no known exploits in the wild have been reported for this indicator.

Summary

OffSeq Mirage honeypot sensors detected a specific malicious file identified by the SHA-256 hash ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529b on July 19, 2026. The file was observed 11 times in attacker activity linked to the T1105 technique, which involves ingress tool transfer. This hash fingerprints a malicious payload that may be a dropper, web shell, miner, or post-exploitation tool staged or delivered during attacks. The attacker infrastructure was located in the Philippines. This is an indicator of compromise (IOC) rather than a vulnerability or exploit. No CVE or patch information is associated with this hash.

Impact

The presence of this malicious file in an environment indicates potential compromise or attacker activity involving tool transfer. The file could facilitate further malicious actions such as payload deployment or post-exploitation activities. However, there is no direct indication of a vulnerability or exploit targeting specific software versions. No known exploits in the wild have been reported for this indicator.

Defensive guidance

Organizations should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR) systems, antivirus (AV) solutions, and threat intelligence feeds to detect potential compromise. If found, incident response procedures should be initiated to contain and remediate the threat. No patch or official fix applies as this is an indicator of malicious activity rather than a software vulnerability.

Indicators of compromise

Hashes 1

ee793426a461ac5fc085115c485384c4bddff626b12c87b7663203fbd524529bOffSeq Mirage — a malicious file, observed 2026-07-19..2026-07-19, 11×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:27 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats