An independent reverse engineering analysis published by 0x0d4y Malware Research provides a deep technical walkthrough of ScoringMathTea — a C++ Remote Access Trojan developed and operated by Lazarus Group, identified by ESET Research in October 2025 as part of Operation DreamJob's "Gotta Fly" instance targeting companies supplying Unmanned Aerial Vehicle technology to Ukraine. ScoringMathTea is a modular, evasion-focused RAT whose most critical capability is a reflective in-memory plugin loader backed by a manually constructed API table built via PEB Walking — bypassing user-mode security hooks entirely.
Execution Entry and Configuration Initialization
ScoringMathTea is delivered as a DLL. DllMain immediately spawns a thread via CreateThread pointing to the RAT's main function. The main function initializes a pseudo-random seed using GetTickCount64 followed by srand, then calls smt_init_config to populate a configuration struct. C&C URLs are stored as Stack Strings — constructed character-by-character at runtime to prevent extraction by static string analysis tools. The configuration struct also allocates slots for additional C&C addresses (initialized as null, likely populated dynamically during operations) and stores a campaign or build ID.
String Deobfuscation: Polyalphabetic Substitution with Output Chaining
Before resolving APIs, ScoringMathTea deobfuscates its strings using a custom polyalphabetic cipher with chaining. The algorithm operates against a 64-character lookup table ("pB1Q5ZyneCb6sR03u2OxfK8vVMkEaow_ciSDYIUmlF4hq9XLPJNzTHGgr.WtdA7") with an initial key state of 11. For each character: the obfuscated character is located in the lookup table to get its index; the current key state is subtracted from that index with a bitwise AND of 0x3F (modulo 64, handling underflow); the result indexes back into the same table for the decoded character. After decoding, the key state is updated by adding the decoded character's value and applying modulo 64 — making each subsequent character's decryption key dependent on the previous decoded output. The decoded string is stored as both a char* and an adjacent wchar_t* buffer.
API Hashing and the Manual API Table
Following string deobfuscation, ScoringMathTea loads all required Windows API functions via API Hashing rather than standard IAT imports. The core evasion mechanism is smt_load_apis_dlls, which implements PEB Walking to locate kernel32.dll and obtain a clean, unhooked pointer to GetProcAddress — bypassing any user-mode hooks an EDR may have placed on the standard import table. Using this clean pointer, the malware constructs a private runtime API table (smt_api_table) containing unhookable pointers to VirtualAlloc, VirtualProtect, LoadLibraryA, and other essential functions. All subsequent malware operations use this table exclusively, never touching the potentially monitored standard IAT.
Reflective Plugin Loader: In-Memory Execution Without Disk Writes
ScoringMathTea's most operationally significant capability is its reflective plugin loader (smt_reflective_plugin_loader). When the operator issues a plugin load command, the loader downloads an encrypted DLL payload over the C&C channel, performs manual PE mapping entirely in memory using the clean API table, resolves the plugin's imports, applies base relocations, verifies module integrity via a dynamically generated CRC32 checksum, applies correct memory permissions per section via smt_set_section_protections, and finally executes the plugin by calling its exported function "exportfun". No plugin file is written to disk at any point, making the loaded capability invisible to file-based detection and forensic triage.
C&C Communication: Multi-Layer Encrypted HTTP/S
C&C communication operates over HTTP/S with SSL certificate validation bypassed. Command payloads are protected through multiple layers: Base64 encoding, encryption assessed as TEA or XTEA in CBC mode, and optional compression. The combination of SSL bypass, custom encryption, and Base64 encoding makes the C&C traffic resistant to both TLS inspection and payload-based network signatures. The overall architecture — modular plugin loading, PEB-walked API resolution, stack string C&C storage, and polyalphabetic string obfuscation — reflects a RAT designed from the ground up for long-term operational persistence against EDR-equipped enterprise environments.