IndicatorPublished 08/06/2026

Malicious SHA-256 file hash f2291321df3b… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6c was observed by OffSeq Mirage honeypot sensors on August 6, 2026. This file was detected six times during attacker activity involving the T1105 technique (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Ethiopia, India, and Turkey. There is no known exploit in the wild or vendor patch information associated with this indicator. Organizations are advised to match this hash against files in their environment and security feeds.

Summary

OffSeq Mirage honeypot sensors detected a specific malicious file identified by SHA-256 hash f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6c during attacker activity on 2026-08-06. The attack technique observed was T1105 (Ingress Tool Transfer), indicating the file was staged or delivered as part of an attack. The malicious payload type is not precisely identified but may include droppers, web shells, miners, or post-exploitation tools. The attacker infrastructure was located in Ethiopia, India, and Turkey. No CVE or patch information is associated with this indicator, and no known exploits in the wild have been reported.

Impact

This indicator represents a malicious payload used in attacker activity, potentially enabling unauthorized tool transfer and execution within targeted environments. The exact impact depends on the payload type (dropper, web shell, miner, or post-exploitation tool), which could facilitate further compromise, persistence, or resource abuse. No confirmed active exploitation or widespread impact is reported.

Defensive guidance

No official patch or remediation is applicable as this is an indicator of compromise (IOC) rather than a software vulnerability. Organizations should use this SHA-256 hash to scan their environments and security telemetry for presence of the malicious file. Updating endpoint detection and response (EDR) and antivirus (AV) signatures with this indicator is recommended to detect and block this threat.

Indicators of compromise

Hashes 1

f2291321df3b93aed41359a2f5f3fa22bf4a16da1a13343cc3daca9657fbac6cOffSeq Mirage — a malicious file, observed 2026-08-06..2026-08-06, 6×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:08 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats