🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a.

Database Entry


IOC ID:1974648
IOC: 3196034ef1196c9151395859019674e14e3c06e3fdbf230c7e0d0c5f6211824a
IOC Type :sha256_hash
Threat Type :payload
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-10-20 05:14:05 UTC
Last seen:never
UUID:d9b5e283-cbfb-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:analystic DarkSword GHOSTBLADE ios P7
Reference: https://x.com/vxunderground/status/2112234562805739834

Avatar
Darkfibr
iOS >=18 DarkSword/P7-lineage chain: loader, 18.6/non-18.6 workers, RCE, sbx0 GPU escape, sbx1 mediaplaybackd LPE, PE main (kernel LPE + keychain/wallet implant). 455b474e is byte-identical to iVerify P7 rce_module_18.6.js. Static only; no execution.