rule ios_coruna_w5 {
    meta:
        description = "Detects Coruna C2 domain and URL construction patterns"
        author = "@Nadsec"
        severity = "critical"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $domain = "b27.icu" ascii nocase
        $double_ext = ".min.js.js" ascii
        $query_param = "?e=" ascii
        $xhr = "XMLHttpRequest" ascii

    condition:
        $domain or (filesize < 500KB and $double_ext and $query_param and $xhr)
}