tokens: The payload, distributed disguised as antivirus, is a variant of Korplug RAT aka PlugX – a spyware with former associations with Chinese APT groups, and known from targeted attacks at important institutions of various countries.