rule ios_coruna_w6 {
    meta:
        description = "Detects Coruna's minimal Wasm R/W adapter modules by byte pattern"
        author = "@Nadsec"
        severity = "critical"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        // Wasm magic + version + type section for the 92-byte minimal adapter
        $wasm_magic = { 00 61 73 6D 01 00 00 00 }
        $export_btl = "btl" ascii
        $export_alt = "alt" ascii
        $bigint_check = "BigUint64Array" ascii

    condition:
        filesize < 500KB and $wasm_magic and $export_btl and $export_alt and $bigint_check
}