🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 2e443833dd58278d094acda2067a43cae1e88cbdf3902d7515776ab42f41b7e8.

Database Entry


IOC ID:1974645
IOC: 2e443833dd58278d094acda2067a43cae1e88cbdf3902d7515776ab42f41b7e8
IOC Type :sha256_hash
Threat Type :payload
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-10-20 05:14:08 UTC
Last seen:never
UUID:d99adacd-cbfb-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:analystic DarkSword GHOSTBLADE ios P7
Reference: https://x.com/vxunderground/status/2112234562805739834

Avatar
Darkfibr
iOS >=18 DarkSword/P7-lineage chain: loader, 18.6/non-18.6 workers, RCE, sbx0 GPU escape, sbx1 mediaplaybackd LPE, PE main (kernel LPE + keychain/wallet implant). 455b474e is byte-identical to iVerify P7 rce_module_18.6.js. Static only; no execution.