tokens: This post will use the PlugX malware as an example PlugX is well known and has had its various iterations analyzed many times, due in part to its ongoing activity and will focus on leveraging metadata from VirusTotal due to it being publicly accessible.