IndicatorPublished 30 Oct 2026

Malicious SHA-256 file hash fe06eb908f0b… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-10-30..2026-10-30, 4×

fe06eb908f0b5c042ea623f4e30e822d498b1b410862528b9df59ca52a57e837

Description

A malicious file identified by the SHA-256 hash fe06eb908f0b5c042ea623f4e30e822d498b1b410862528b9df59ca52a57e837 was observed by OffSeq Mirage honeypot sensors on 2026-10-30. This file was seen four times in attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in Bulgaria. The file hash corresponds to a specific malicious payload, which could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.

Impact

The malicious file associated with this hash was involved in attacker activity using the Ingress Tool Transfer technique, suggesting it was used to deliver or stage malicious payloads such as droppers, web shells, miners, or post-exploitation tools. This implies potential unauthorized access, persistence, or resource abuse in compromised environments. However, no direct evidence of exploitation or active campaigns beyond the observed activity is provided.

Defensive guidance

No specific patch or remediation is applicable as this is an indicator of compromise (IOC) rather than a software vulnerability. Organizations should match this SHA-256 hash against files in their environments and security telemetry such as EDR, antivirus, and threat intelligence feeds to detect and respond to potential infections. Monitoring for T1105 technique activity and blocking known malicious payloads by hash can help mitigate risk.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 31 Oct 2026, 00:07 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats