APT Lazarus Scoringmathtea CRC32 Check

Tim Peck@timpeck

•updated Nov 19, 2025•5•2•68

Detects ScoringMathTea malware by identifying its custom in-line CRC32 table generation routine. This routine, used for integrity checks and anti-debugging, utilizes a unique polynomial constant (0x04C10DB7).