IndicatorPublished 08/07/2026Updated 08/29/2026

Malicious SHA-256 file hash f2e2ffc024ab… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36 was observed 182 times in attacker activity between August 7 and August 29, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Argentina, Brazil, Canada, China, Indonesia, India, Italy, and Jordan. The hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. This indicator should be matched against files in environments and security tools to detect potential compromise. No known exploits in the wild or vendor patches are applicable.

Summary

OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36 during August 2026. The file is linked to the MITRE ATT&CK technique T1105, indicating it is used for ingress tool transfer, suggesting it is part of attacker tool delivery or staging. The file may represent various malicious payload types such as droppers, web shells, miners, or post-exploitation tools. The activity was observed from attacker infrastructure spanning several countries. This is an indicator of compromise (IOC) rather than a vulnerability or exploit. No patch or remediation is applicable as this is a detection indicator.

Impact

The presence of this file hash in an environment indicates potential attacker activity involving tool transfer and deployment of malicious payloads. The impact depends on the payload type, which may include unauthorized access, persistence, resource abuse, or further exploitation. However, no direct exploit or vulnerability is described. Detection of this hash can help identify and respond to attacker activity.

Defensive guidance

No patch or official remediation is applicable as this is an indicator of compromise. Security teams should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect potential infections. Appropriate incident response should follow if the file is found.

Indicators of compromise

Hashes 1

f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36OffSeq Mirage — a malicious file, observed 2026-08-07..2026-08-29, 182×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:01 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats