IndicatorPublished 1 Jul 2026Updated 9 Jul 2026

Malicious SHA-256 file hash f8183b625153… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-01..2026-07-01, 50×

f8183b625153b4b06f974c697d52a2d273a4e7d981f4f33e8ff27c203653f600

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 162 time(s) in attacker activity between 2026-07-01 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in CN, HK, VN, EG, KR, US, IR, TW. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer of malicious payloads into a target environment. The impact depends on the payload type (dropper, web shell, miner, or post-exploitation tool), which can lead to unauthorized access, persistence, resource abuse, or further exploitation. However, no direct exploit or vulnerability is described, and no known active exploitation has been confirmed.

Defensive guidance

Organizations should use this SHA-256 hash to scan their environments, including endpoint detection and response (EDR) and antivirus (AV) systems, to identify and remove any matching malicious files. Incorporate this indicator into threat intelligence feeds and monitor for related attacker activity. Follow standard incident response procedures if the file is detected.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 1 Jul 2026, 06:51 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats