rule ios_coruna_w1 {
    meta:
        description = "Detects Coruna's vKTo89/OLdwIx module namespace registration"
        author = "@Nadsec"
        severity = "critical"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $ns1 = "vKTo89" ascii
        $ns2 = "OLdwIx" ascii
        $register = "tI4mjA" ascii
        $hash1 = "1ff010bb3e857e2b0383f1d9a1cf9f54e321fbb0" ascii
        $hash2 = "6b57ca3347345883898400ea4318af3b9aa1dc5c" ascii

    condition:
        filesize < 500KB and $register and (any of ($ns*)) and (any of ($hash*))
}