IndicatorPublished 07/21/2026

Malicious SHA-256 file hash ef42e6fd238b… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019 was observed twice on July 21, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Great Britain. This indicator can be used to detect the presence of this specific malicious file in environments by matching the hash against files and threat intelligence feeds.

Summary

OffSeq Mirage honeypot sensors detected a specific malicious file with SHA-256 hash ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019 during attacker activity on July 21, 2026. The observed technique was T1105 (Ingress Tool Transfer), indicating the file was staged or delivered as part of an attack. The file hash fingerprints a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was identified as being in Great Britain. This is an indicator of compromise (IOC) useful for detection and response but does not describe a specific software vulnerability or exploit code.

Impact

The presence of this malicious file indicates attacker activity involving the transfer of a harmful payload into a target environment. The impact depends on the nature of the payload, which may include dropping additional malware, establishing persistence, mining cryptocurrency, or enabling post-exploitation actions. No direct exploit or vulnerability is described. The threat is limited to detection and response based on this IOC.

Defensive guidance

Match the provided SHA-256 hash against files in your environment, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to identify potential compromise. There is no patch or fix because this is an indicator of a malicious file rather than a software vulnerability. Use this IOC to enhance detection and investigation capabilities. No further vendor remediation is applicable.

Indicators of compromise

Hashes 1

ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019OffSeq Mirage — a malicious file, observed 2026-07-21..2026-07-21, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:16 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats