🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash da3fe94ac1ffe0ae01adfab6d5e6cd58933e93853c4b6e664f76ca468981bb02.

Database Entry


IOC ID:1974652
IOC: da3fe94ac1ffe0ae01adfab6d5e6cd58933e93853c4b6e664f76ca468981bb02
IOC Type :sha256_hash
Threat Type :payload
Malware: GHOSTBLADE
Confidence Level : Confidence level is high (90%)
Is compromised? : False
First seen:2026-10-20 05:14:02 UTC
Last seen:never
UUID:d9d57ba0-cbfb-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:analystic DarkSword GHOSTBLADE ios P7
Reference: https://x.com/vxunderground/status/2112234562805739834

Avatar
Darkfibr
iOS >=18 DarkSword/P7-lineage chain: loader, 18.6/non-18.6 workers, RCE, sbx0 GPU escape, sbx1 mediaplaybackd LPE, PE main (kernel LPE + keychain/wallet implant). 455b474e is byte-identical to iVerify P7 rce_module_18.6.js. Static only; no execution.