🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 9c7f86f2b82df171a09f096afcd8fa5b6b24f0b643aae765ad17ecf80dadb196.

Database Entry


IOC ID:1974650
IOC: 9c7f86f2b82df171a09f096afcd8fa5b6b24f0b643aae765ad17ecf80dadb196
IOC Type :sha256_hash
Threat Type :payload
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-10-20 05:14:04 UTC
Last seen:never
UUID:d9c57492-cbfb-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:analystic DarkSword GHOSTBLADE ios P7
Reference: https://x.com/vxunderground/status/2112234562805739834

Avatar
Darkfibr
iOS >=18 DarkSword/P7-lineage chain: loader, 18.6/non-18.6 workers, RCE, sbx0 GPU escape, sbx1 mediaplaybackd LPE, PE main (kernel LPE + keychain/wallet implant). 455b474e is byte-identical to iVerify P7 rce_module_18.6.js. Static only; no execution.