IndicatorPublished 07/13/2026Updated 07/15/2026

Malicious SHA-256 file hash f2ca1bb6c7e9… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 was observed by OffSeq Mirage honeypot sensors during attacker activity between July 13 and July 15, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Spain. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was observed six times in the wild during this period. No specific affected software versions or patches are identified. No known exploits in the wild or threat actors are linked to this indicator.

Summary

OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2 during attacker activity from July 13 to July 15, 2026. The activity involved the ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was observed six times and traced back to attacker infrastructure located in Spain. This indicator serves as a fingerprint for detection and correlation in security tools but does not specify a vulnerability or exploit. No patch or remediation information is available.

Impact

The presence of this malicious file hash indicates potential compromise or attacker activity involving the transfer and deployment of malicious payloads. The impact depends on the payload type (dropper, web shell, miner, or post-exploitation tool) but is not explicitly detailed in the data. No active exploitation or specific vulnerabilities are confirmed. Detection of this file in an environment suggests a security incident requiring investigation.

Defensive guidance

No patch or remediation is specified for this indicator. Security teams should match this SHA-256 hash against files in their environment and correlate with endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds. Monitoring for this hash can help identify and respond to attacker activity involving this payload. Follow standard incident response procedures upon detection.

Indicators of compromise

Hashes 1

f2ca1bb6c7e907d06dafe4687e579fce76b37e4e93b7605022da52e6ccc26fd2OffSeq Mirage — a malicious file, observed 2026-07-13..2026-07-15, 6×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:05 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats