IndicatorPublished 07/23/2026

Malicious SHA-256 file hash efa731b59f9e… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2 was observed by OffSeq Mirage honeypot sensors on July 23, 2026. The file was detected twice during attacker activity involving the T1105 technique (Ingress Tool Transfer). This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in Germany (DE).

Summary

OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2 on July 23, 2026. The file was involved in attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the transfer of tools or payloads into a target environment. The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was identified as being located in Germany. This indicator should be matched against enterprise files and endpoint detection and response (EDR) or antivirus (AV) feeds to detect potential compromise.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer of malicious tools or payloads into a target environment. The payload could facilitate further malicious activities such as persistence, data exfiltration, or resource abuse. However, no active exploitation or widespread attacks are confirmed at this time.

Defensive guidance

No specific patch or remediation is applicable as this is an indicator of compromise (IOC). Organizations should match this SHA-256 hash against their internal file stores, EDR, and AV telemetry to detect and remove any instances of this malicious payload. Monitoring for T1105 activity and blocking known attacker infrastructure IPs may also help reduce risk.

Indicators of compromise

Hashes 1

efa731b59f9e2f277336072fe5c72b488793c842e2efeedf5cb571a0eeb224e2OffSeq Mirage — a malicious file, observed 2026-07-23..2026-07-23, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:12 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats