tokens: Technical details Here is the meta information for the observed samples , certificates and hardcoded version stamps : Certificate MD5 Module Version Serial Number : 0x76607c02 Issuer : CN=Ron Validity : from = Tue Aug 30 13:01:30 MSK 2016 to = Sat Aug 24 13:01:30 MSK 2041 Subject : CN=Ron 9e005144ea1a583531f86663a5f14607 1 – 18abe28730c53de6d9e4786c7765c3d8 2 2.0 Serial Number : 0x6a0d1fec Issuer : CN=Sun Validity : from = Mon May 16 17:42:40 MSK 2016 to = Fri May 10 17:42:40 MSK 2041 Subject : CN=Sun 9ffc350ef94ef840728564846f2802b0 2 v2.51sun 6c246bbb40b7c6e75c60a55c0da9e2f2 2 v2.96s 7c8a12e56e3e03938788b26b84b80bd6 2 v3.09s bde7847487125084f9e03f2b6b05adc3 2 v3.12s 2560942bb50ee6e6f55afc495d238a12 2 v3.18s It ’ s interesting that the issuer “ Sun ” matches the “ Sun1 ” and “ Sun2 ” identifiers of infected devices from the FTP server , suggesting they may be test devices .