IndicatorPublished 07/12/2026Updated 07/16/2026

Malicious SHA-256 file hash f370b32bab1c… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 was observed 436 times in attacker activity between July 12 and July 16, 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure in multiple countries. This indicator can be used to detect and block the associated malicious payload in environments and security tools. No known exploits or active threat actors are currently linked to this file hash.

Summary

OffSeq Mirage honeypot sensors detected a specific malicious file identified by SHA-256 hash f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4 during attacker operations from July 12 to July 16, 2026. The observed technique was T1105 (Ingress Tool Transfer), which involves transferring tools or payloads into a target environment. The file hash fingerprints a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The malicious activity was traced to attacker infrastructure in countries including Armenia, Argentina, Azerbaijan, Bulgaria, Brazil, Botswana, Canada, and Ivory Coast. There is no indication of known exploits in the wild or specific threat actor attribution. This hash serves as an indicator of compromise (IOC) for detection and response.

Impact

The malicious file identified by this hash is associated with attacker activity involving tool transfer into victim environments, potentially enabling further compromise through payload execution such as dropping malware, establishing web shells, mining cryptocurrency, or conducting post-exploitation actions. While no active exploitation or threat actor attribution is confirmed, the presence of this file in an environment indicates a security breach or attempted intrusion.

Defensive guidance

No official patch or remediation is applicable as this is an indicator of compromise rather than a software vulnerability. Security teams should use this SHA-256 hash to scan and detect the malicious file in their environments using endpoint detection and response (EDR) tools, antivirus solutions, and threat intelligence feeds. Blocking or quarantining files matching this hash and investigating related activity is recommended to mitigate risk.

Indicators of compromise

Hashes 1

f370b32bab1c20f235c9b88189c9e0769796f183bff521938acd4d69840e7ae4OffSeq Mirage — a malicious file, observed 2026-07-12..2026-07-16, 436×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:41:58 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats