id: plasma-malware

info:
  name: Plasma Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RAT_Ratdecoders.yar
  tags: malware,file
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - "Miner: Failed to Inject."
          - "Started GPU Mining on:"
          - "BK: Hard Bot Killer Ran Successfully!"
          - "Uploaded Keylogs Successfully!"
          - "No Slowloris Attack is Running!"
          - "An ARME Attack is Already Running on"
          - "Proactive Bot Killer Enabled!"
          - "PlasmaRAT"
          - "AntiEverything"
        condition: and
# digest: 490a0046304402200bdea5153064fd01b1825e406f867e3f2057927f7d4d937446dd487ce68477ff0220270d3bdcc96ce1c36e4ce7517932d773ab72a34670dc3ea9e20e5cfd30b5ee8d:922c64590222798bb761d5b6d8e72950