IndicatorPublished 07/18/2026

Malicious SHA-256 file hash f74a8b06db4f… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d was observed by OffSeq Mirage honeypot sensors during attacker activity between July 18 and July 19, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in the Netherlands and the United States. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise. No known exploits in the wild have been reported for this file. No affected software versions or patches are applicable as this is an indicator of compromise rather than a vulnerability.

Summary

OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843d during attacker activity on July 18-19, 2026. The file is linked to the ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in the Netherlands and the United States. This indicator should be matched against files in enterprise environments and security detection tools to identify potential compromise. There is no information about active exploitation or affected software versions, and no patches or fixes are relevant.

Impact

The presence of this malicious file hash indicates that an attacker has staged or delivered a malicious payload within a target environment using the Ingress Tool Transfer technique. The payload could facilitate further malicious activities such as system compromise, persistence, or resource abuse. However, no active exploitation or widespread incidents have been reported. Detection of this hash in an environment suggests potential compromise requiring investigation.

Defensive guidance

As this is an indicator of compromise (IOC) rather than a vulnerability, no patch or fix is applicable. Organizations should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR) systems, antivirus (AV) solutions, and threat intelligence feeds to identify and remediate any presence of this malicious payload. Monitoring for related attacker activity and applying standard incident response procedures upon detection is recommended.

Indicators of compromise

Hashes 1

f74a8b06db4f8f48f4a19ea5c01bade2a0dfb9290c4ed04a3f1a3eaa298a843dOffSeq Mirage — a malicious file, observed 2026-07-18..2026-07-19, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:31:14 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats