IndicatorPublished 07/16/2026

Malicious SHA-256 file hash f6b70a84aaa3… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef was observed by OffSeq Mirage honeypot sensors during attacker activity between July 16 and July 17, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in China, Malaysia, Pakistan, and Russia. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The threat intelligence advises matching this hash against files in your environment and security tools. No known exploits or patches are reported for this indicator.

Summary

OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739ef during attacker activity from July 16 to July 17, 2026. The activity involved the MITRE ATT&CK technique T1105, which is used for ingress tool transfer, indicating the file was staged or delivered as part of an attack. The file is linked to attacker infrastructure located in China, Malaysia, Pakistan, and Russia. The malicious payload could be one of several types including a dropper, web shell, miner, or post-exploitation tool. This indicator serves as a fingerprint for detection and blocking within security environments. There is no vendor advisory or patch information available, and no active exploits are known in the wild.

Impact

The presence of this malicious file hash indicates potential attacker activity involving the transfer of tools or payloads into a target environment. The payload could facilitate further compromise such as dropping additional malware, establishing web shells, mining cryptocurrency, or conducting post-exploitation activities. Although no active exploits are reported, detection of this hash in an environment suggests a security incident or attempted intrusion.

Defensive guidance

No official patch or remediation is available as this is an indicator of compromise rather than a software vulnerability. Security teams should use this SHA-256 hash to scan and detect the malicious file within their environments using endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds. Blocking or quarantining files matching this hash is recommended. Monitor for related attacker activity consistent with MITRE ATT&CK technique T1105. Follow standard incident response procedures if the file is found.

Indicators of compromise

Hashes 1

f6b70a84aaa31d0f4a3521f6ef91368be93d04b2153198c01731df22b96739efOffSeq Mirage — a malicious file, observed 2026-07-16..2026-07-17, 4×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:32:56 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats