Coruna/DarkSword iOS Exploit Frameworks & Polymarket Supply-Chain Wallet Drainer: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Coruna/DarkSword iOS Exploit Framework Network Beaconing
id: 9b8a7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d
status: experimental
description: Detects network communication to Coruna/DarkSword C2 infrastructure and WebKit exploit delivery domains
author: Security Arsenal Threat Intel
references:
    - https://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation
logsource:
    category: proxy
    product: zeek
detection:
    selection_domain:
        - 'ax.xoovo.top'
        - 'ccsigen321qc.com'
        - 'echomint.buzz'
        - 'melatibiru.win'
        - 'trxusdt.vip'
        - 'gkxtguomb5mrs16.xyz'
        - 'ipsadminuser.shop'
    selection_tld:
        - '.top'
        - '.xyz'
        - '.vip'
        - '.win'
    condition: selection_domain or (selection_tld and selection_ua)
    selection_ua:
        - '*iPhone*'
        - '*iPad*'
        - '*CPU iPhone OS*'
falsepositives:
    - Legitimate cryptocurrency sites using .vip or .win TLDs (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1071.001
---
title: WebKit Exploitation Attempt - iOS Drive-By Compromise
id: 8a7b6c5d-4e3f-2a1b-0c9d-8e7f6a5b4c3d
status: experimental
description: Detects potential WebKit exploit delivery targeting iOS devices via suspicious MIME types or JavaScript patterns
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs_user_agent|contains:
            - 'iPhone OS 17'
            - 'iPhone OS 16'
            - 'CPU iPhone OS'
        sc_status: 200
        cs_uri_stem|endswith:
            - '.js'
            - '.html'
            - '.wasm'
    filter:
        cs_referer|contains:
            - 'apple.com'
            - 'icloud.com'
    condition: selection and not filter
level: medium
tags:
    - attack.t1189
    - attack.t1203
---
title: Polymarket Supply Chain Compromise - Malicious JavaScript Injection
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects execution or loading of known malicious DebugBear CDN scripts associated with Polymarket wallet draining
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'debugbear.com'
            - 'cdn.debugbear.com'
        Image|endswith:
            - 'chrome.exe'
            - 'firefox.exe'
            - 'msedge.exe'
            - 'brave.exe'
    condition: selection
falsepositives:
    - Legitimate DebugBear performance monitoring (if organization uses this service)
level: critical
tags:
    - attack.t1195.002
    - attack.t1059.007
    - attack.t1557

// Hunt for Coruna/DarkSword C2 communications and WebKit exploit delivery
// Targets network connections from iOS devices to known malicious infrastructure
let coruna_domains = dynamic(["ax.xoovo.top", "ccsigen321qc.com", "echomint.buzz", "melatibiru.win", "trxusdt.vip", "gkxtguomb5mrs16.xyz", "ipsadminuser.shop"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in~ (coruna_domains) or RemoteUrl endswith ".top" or RemoteUrl endswith ".xyz"
| where DeviceName has_any ("iPhone", "iPad", "iPod") or InitiatingProcessFileName has_any ("Safari", "WebKit")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Alternative query for Windows/macOS devices accessing Polymarket with DebugBear compromise
let drainer_hashes = dynamic(["01c5bc78c4118115bd849ad34e3c42d7ff39479a0feb5b216b1e1ffdc02f853d", "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("chrome.exe", "firefox.exe", "msedge.exe", "brave.exe")
| where ProcessCommandLine has_any ("polymarket", "debugbear")
| join kind=inner (
    DeviceFileEvents
    | where SHA256 in~ (drainer_hashes) or SHA1 == "f908fe564ea73067b09ab1f0c5d683970020fbca"
) on DeviceId
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, FolderPath;

# IOC Hunt Script - Coruna/DarkSword and Polymarket Supply Chain Compromise
# Run with elevated privileges for registry and network inspection

$ErrorActionPreference = "SilentlyContinue"
$report = @()

# Known malicious domains from OTX pulses
$corunaDomains = @(
    "ax.xoovo.top",
    "ccsigen321qc.com",
    "echomint.buzz",
    "melatibiru.win",
    "trxusdt.vip",
    "gkxtguomb5mrs16.xyz",
    "ipsadminuser.shop"
)

$drainerHashes = @(
    "01c5bc78c4118115bd849ad34e3c42d7ff39479a0feb5b216b1e1ffdc02f853d",
    "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5",
    "f908fe564ea73067b09ab1f0c5d683970020fbca"
)

Write-Host "[+] Starting IOC Hunt for Coruna/DarkSword and Polymarket Drainer..." -ForegroundColor Cyan

# Check DNS Cache for Coruna domains
Write-Host "[+] Checking DNS Cache..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -match "coruna|darksword|xoovo|ccsigen|echomint|melatibiru|trxusdt|gkxtguomb|ipsadminuser" }
if ($dnsCache) {
    $report += [PSCustomObject]@{
        Type = "DNS Cache Hit"
        Indicator = ($dnsCache.Entry -join ", ")
        Severity = "High"
        Description = "Coruna/DarkSword C2 domain resolution detected"
    }
}

# Check active network connections to malicious infrastructure
Write-Host "[+] Checking Network Connections..." -ForegroundColor Yellow
$netConnections = Get-NetTCPConnection | Where-Object { $_.State -eq "Established" } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        LocalAddress = $_.LocalAddress
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        ProcessName = $proc.ProcessName
        ProcessId = $_.OwningProcess
    }
}

# Resolve remote IPs and check against threat intel (simplified - in production use TI API)
foreach ($conn in $netConnections | Where-Object { $_.RemotePort -eq 443 -or $_.RemotePort -eq 80 }) {
    try {
        $hostname = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
        if ($corunaDomains -contains $hostname -or $hostname -match "debugbear") {
            $report += [PSCustomObject]@{
                Type = "Network Connection"
                Indicator = "$($conn.RemoteAddress):$($conn.RemotePort) ($hostname)"
                Severity = "Critical"
                Description = "Active connection to malicious infrastructure by $($conn.ProcessName)"
            }
        }
    } catch {}
}

# Check for suspicious JavaScript files in browser caches (Chrome/Edge)
Write-Host "[+] Checking Browser Caches for Malicious JS..." -ForegroundColor Yellow
$browserCachePaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cache",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Cache"
)

foreach ($cachePath in $browserCachePaths) {
    if (Test-Path $cachePath) {
        $jsFiles = Get-ChildItem -Path $cachePath -Recurse -Filter "*.js" -ErrorAction SilentlyContinue | Select-Object -First 50
        foreach ($file in $jsFiles) {
            $hash = Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($drainerHashes -contains $hash.Hash) {
                $report += [PSCustomObject]@{
                    Type = "Malicious File"
                    Indicator = $file.FullName
                    Severity = "Critical"
                    Description = "Polymarket drainer script detected (SHA256: $($hash.Hash))"
                }
            }
            # Check for suspicious wallet-draining patterns in JS
            $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match "ethereum|web3|signer|portfolio|transfer" -and $content -match "debugbear") {
                $report += [PSCustomObject]@{
                    Type = "Suspicious JavaScript"
                    Indicator = $file.FullName
                    Severity = "High"
                    Description = "Potential wallet-draining script with DebugBear compromise indicators"
                }
            }
        }
    }
}

# Check for iOS device backups (if analyzing workstation that syncs with iOS)
Write-Host "[+] Checking for iOS Backup Artifacts..." -ForegroundColor Yellow
$backupPaths = @(
    "$env:APPDATA\Apple Computer\MobileSync\Backup",
    "$env:USERPROFILE\Apple\MobileSync\Backup"
)

foreach ($path in $backupPaths) {
    if (Test-Path $path) {
        $suspiciousFiles = Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Name -match "coruna|darksword|webkit" }
        if ($suspiciousFiles) {
            $report += [PSCustomObject]@{
                Type = "iOS Backup Artifact"
                Indicator = $path
                Severity = "Medium"
                Description = "Suspicious filenames detected in iOS backup - possible Coruna infection"
            }
        }
    }
}

# Registry check for cryptocurrency wallet persistence (browser extensions)
Write-Host "[+] Checking Browser Extension Registry Keys..." -ForegroundColor Yellow
$chromeExtPath = "HKLM:\SOFTWARE\Google\Chrome\Extensions"
$edgeExtPath = "HKLM:\SOFTWARE\Microsoft\Edge\Extensions"

foreach ($regPath in @($chromeExtPath, $edgeExtPath)) {
    if (Test-Path $regPath) {
        $extensions = Get-ChildItem -Path $regPath
        foreach ($ext in $extensions) {
            $extName = $ext.PSChildName
            # Check for suspicious extension IDs (would need to correlate with known malicious IDs)
            if ($extName -match "[a-z]{32}") {  # Chrome extension ID pattern
                $report += [PSCustomObject]@{
                    Type = "Browser Extension"
                    Indicator = $extName
                    Severity = "Low"
                    Description = "Browser extension detected - verify legitimacy (potential vector for supply chain attacks)"
                }
            }
        }
    }
}

# Output Report
Write-Host "`n[+] IOC Hunt Complete. Findings:" -ForegroundColor Green
if ($report.Count -eq 0) {
    Write-Host "No IOCs detected." -ForegroundColor Green
} else {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "IOCHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "`nReport exported to IOCHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -ForegroundColor Cyan
}

# Recommended immediate actions
if ($report | Where-Object { $_.Severity -eq "Critical" }) {
    Write-Host "`n[!] CRITICAL FINDINGS DETECTED - ISOLATE HOST IMMEDIATELY" -ForegroundColor Red
    Write-Host "Recommended actions:" -ForegroundColor Red
    Write-Host "1. Disable network adapters: Get-NetAdapter | Disable-NetAdapter -Confirm:`$false" -ForegroundColor Yellow
    Write-Host "2. Reset cryptocurrency wallet sessions and revoke API keys" -ForegroundColor Yellow
    Write-Host "3. Reset passwords for any accounts accessed from this device" -ForegroundColor Yellow
}