IndicatorPublished 29 Oct 2026

Malicious SHA-256 file hash f60c2c8b0980… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-10-29..2026-10-29, 2×

f60c2c8b098025a65c50bc7eb3f2d92a5bd4a6f0915cbb921c0f275dbea410e1

Description

A malicious file identified by the SHA-256 hash f60c2c8b098025a65c50bc7eb3f2d92a5bd4a6f0915cbb921c0f275dbea410e1 was observed twice on October 29, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and is linked to attacker infrastructure located in the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.

Impact

The malicious file represents a threat as it is associated with attacker activity involving the transfer of tools or payloads into victim environments. The payload could facilitate further compromise through dropping additional malware, establishing backdoors, mining cryptocurrency, or conducting post-exploitation activities. Detection of this hash can help prevent or mitigate the impact of these malicious actions.

Defensive guidance

No specific patch or remediation is applicable as this is an indicator of compromise (IOC) rather than a software vulnerability. Organizations should use this SHA-256 hash to scan their environments, endpoint detection and response (EDR), antivirus (AV) systems, and threat intelligence feeds to identify and remove the malicious file if present. Monitoring for T1105 technique activity and blocking known attacker infrastructure IPs may also help reduce risk.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:20 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats