IndicatorPublished 08/04/2026

Malicious SHA-256 file hash ee86d4b3017c… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash ee86d4b3017ccb464b3d27332ceed33de1a9e3836e2cf55adced642d210bef7f was observed by OffSeq Mirage honeypot sensors on 2026-08-04. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Israel. This hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools. No known exploits or threat actors are currently linked to this indicator.

Summary

OffSeq Mirage honeypot sensors detected a malicious file with the SHA-256 hash ee86d4b3017ccb464b3d27332ceed33de1a9e3836e2cf55adced642d210bef7f during attacker activity on 2026-08-04. The associated attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The source of the activity was traced to attacker infrastructure located in Israel. This hash serves as an indicator of compromise for defenders to match against their environments and endpoint detection systems. There is no evidence of active exploitation or known threat actors linked to this file at this time.

Impact

The malicious file identified by this hash is linked to attacker activity involving the transfer of tools or payloads into victim environments. Such payloads may facilitate further compromise, persistence, or resource abuse. However, there are no confirmed active exploits or widespread campaigns associated with this indicator. The presence of this file in an environment could indicate an ongoing or attempted intrusion involving post-exploitation or malware deployment.

Defensive guidance

No official patch or remediation is applicable as this is an indicator of compromise rather than a software vulnerability. Organizations should match the provided SHA-256 hash against files in their environments and security telemetry such as EDR and antivirus solutions. If detected, incident response procedures should be initiated to investigate and remediate the presence of the malicious payload. Continuous monitoring for related attacker activity and updating threat intelligence feeds with this indicator is recommended.

Indicators of compromise

Hashes 1

ee86d4b3017ccb464b3d27332ceed33de1a9e3836e2cf55adced642d210bef7fOffSeq Mirage — a malicious file, observed 2026-08-04..2026-08-04, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:23 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats