IndicatorPublished 10/24/2026

Malicious SHA-256 file hash ef251d66663f… (OffSeq Mirage)

Source OffSeq Mirage

Description

The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc. This file was observed 10 times on October 24, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. No specific software versions or products are affected, and no known exploits in the wild have been reported. The threat is an indicator of compromise (IOC) useful for detection and response efforts.

Summary

OffSeq Mirage honeypot sensors observed a specific malicious file hash (SHA-256 ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dc) multiple times during attacker activity on 2026-10-24. The activity involved the MITRE ATT&CK technique T1105, which is ingress tool transfer, indicating the file was staged or delivered as part of an attack. The file hash fingerprints a malicious payload that may function as a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to match against files in environments and endpoint detection and response (EDR) or antivirus (AV) systems to identify potential compromise. There is no information on affected software versions or active exploitation in the wild.

Impact

The presence of this malicious file hash indicates potential attacker activity involving the transfer of a malicious payload into a target environment. The payload could enable further compromise through dropping additional malware, establishing remote access (web shell), mining cryptocurrency, or post-exploitation actions. However, no direct evidence of exploitation or impact severity is provided. The impact is primarily detection of attacker tool presence and potential for subsequent malicious actions.

Defensive guidance

No official patch or fix is applicable as this is an indicator of compromise rather than a software vulnerability. Security teams should use this SHA-256 hash to scan their environments, including endpoint detection and response (EDR) and antivirus (AV) tools, to identify and remediate any presence of the malicious file. Incorporate this indicator into threat intelligence feeds and monitoring systems to detect related attacker activity. Follow standard incident response procedures if the file is found.

Indicators of compromise

Hashes 1

ef251d66663f4a97882fcdcf7622a377c2b3068c26763f73e1ec0a81136342dcOffSeq Mirage — a malicious file, observed 2026-10-24..2026-10-24, 10×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:20 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats