A yara rule written by myself to detect the apparent pattern that most videos spreading malware have

YoutubeMalware.yara

rule MALWARE_VIDEO {
    strings:
        $password = /(PASS|PASSWORD)( )?(:|-)?( )?[0-9A-Za-z]{3,10}/i
        $download = /(http|https):\/\/(yt\.sv|shorturl\.at|clck\.ru|sites\.google\.com|bit\.ly|bit\.do|cutt\.ly|mega\.nz|(www\.)?mediafire\.com|gg\.gg|(www\.)?sendspace\.com|t\.ly|telegra\.ph|split\.to|actgames\.site|goo\.su|easyupload\.io)\/(.*)/i
        $keywords = /(crack|hack|cheat)/i
    condition:
        (all of them) or ($download and $keywords)
}