Do Son A deep-dive on Lazarus’s ScoringMathTea RAT reveals a full reflective DLL injection system, TEA/XTEA C2 encryption, and a polyalphabetic cipher for API hashing—a highly evasive tool for espionage.
API hashing
IIJ exposed a novel loader that simultaneously deploys TorNet (TOR C2) and PureHVNC (RAT) via DLL sideloading. It uses MurmurHash2 for API hashing and injects into jsc.exe for stealth.
Trellix analysis reveals Lumma Stealer's latest tactics: code obfuscation, API hashing, ETW evasion, anti-VM. Learn how this InfoStealer avoids detection.