IndicatorPublished 29 Oct 2026

Malicious SHA-256 file hash fba55fd42a6c… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-10-29..2026-10-29, 3×

fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d

Description

The OffSeq Mirage honeypot sensors detected a malicious file identified by the SHA-256 hash fba55fd42a6cb14c417c3922d09fbcd105bdce13aff48ef908e6a201174a535d. This file was observed three times on October 29, 2026, associated with attacker activity using the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The file is linked to a malicious payload such as a dropper, web shell, miner, or post-exploitation tool delivered during the attack. The attacker infrastructure was located in Romania (RO). There is no information about known exploits in the wild or affected software versions.

Impact

The presence of this malicious file hash indicates potential compromise through ingress tool transfer, which could lead to unauthorized payload delivery such as droppers or web shells. However, no confirmed exploitation or active threat campaigns are reported. The impact is limited to detection of a malicious payload associated with attacker infrastructure.

Defensive guidance

Match this SHA-256 hash against files in your environment and your endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds. No specific patch or fix is applicable as this is an indicator of compromise rather than a vulnerability. Maintain updated detection capabilities to identify this and similar malicious files.

Summary

This indicator represents a malicious file hash observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-10-29. The file hash fingerprints a specific malicious payload involved in ingress tool transfer (T1105), which may be a dropper, web shell, miner, or post-exploitation tool. The activity was traced to attacker infrastructure in Romania. No direct exploit code or active exploitation details are provided, and no affected software versions are specified.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 29 Oct 2026, 23:46 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats