IndicatorPublished 07/15/2026Updated 07/16/2026

Malicious SHA-256 file hash fa4e294690bc… (OffSeq Mirage)

Source OffSeq Mirage

Description

A malicious file identified by the SHA-256 hash fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cd was observed 55 times in attacker activity between July 15 and July 16, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Brazil, Hungary, Indonesia, India, Iran, Pakistan, Russia, and Turkey. The hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect and block this malicious payload in affected environments.

Summary

OffSeq Mirage honeypot sensors detected a malicious file with SHA-256 hash fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cd during attacker activity over a two-day period in July 2026. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The file was seen originating from attacker infrastructure located in several countries across different regions. This hash serves as an indicator of compromise (IOC) for detection and response purposes.

Impact

The presence of this malicious file indicates attacker activity involving the transfer of tools or payloads into a target environment. The payload could enable further compromise through dropping additional malware, establishing remote access (web shell), mining cryptocurrency, or conducting post-exploitation activities. While no active exploits or threat actors are confirmed, detection of this hash is critical to prevent potential compromise.

Defensive guidance

No official patch or fix is applicable as this is an indicator of a malicious file rather than a software vulnerability. Security teams should match this SHA-256 hash against files in their environments and integrate it into endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect and block this payload. Monitoring for T1105 ingress tool transfer activity and blocking communications with known attacker infrastructure in the listed countries may also reduce risk.

Indicators of compromise

Hashes 1

fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cdOffSeq Mirage — a malicious file, observed 2026-07-15..2026-07-16, 55×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:31:10 UTC

Technical details

Indicators of compromise

Hashes 1

References

Related threats