🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash df86db89f7f965fc117d4c14b722d3d02f1d1de5c6ec216bb59fcf2736374caa.

Database Entry


IOC ID:1974647
IOC: df86db89f7f965fc117d4c14b722d3d02f1d1de5c6ec216bb59fcf2736374caa
IOC Type :sha256_hash
Threat Type :payload
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-10-20 05:14:06 UTC
Last seen:never
UUID:d9ae7303-cbfb-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:analystic DarkSword GHOSTBLADE ios P7
Reference: https://x.com/vxunderground/status/2112234562805739834

Avatar
Darkfibr
iOS >=18 DarkSword/P7-lineage chain: loader, 18.6/non-18.6 workers, RCE, sbx0 GPU escape, sbx1 mediaplaybackd LPE, PE main (kernel LPE + keychain/wallet implant). 455b474e is byte-identical to iVerify P7 rce_module_18.6.js. Static only; no execution.