rule ios_coruna_w4 {
    meta:
        description = "Detects Coruna's final payload encryption markers"
        author = "@Nadsec"
        severity = "critical"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $hdr_seed = "HeaderSeed" ascii
        $hdr_key = "HeaderKey" ascii
        $enc_blocks = "EncryptedBlocks" ascii
        $shared_buf = "ArrayBuffer" ascii
        $xor_map = /.map\(x\s*=>\s*\{return String\.fromCharCode/ ascii

    condition:
        filesize < 250KB and all of ($hdr_*) and $enc_blocks and $shared_buf and $xor_map
}