-
Notifications
You must be signed in to change notification settings - Fork 68
Open
Description
I have analyzed a sample of malware-related code and found two numbers related to the TEA algoritm. Those are the numbers and some URLs where you can see more context:
0xb54cda56
0x61c88647
https://blog.csdn.net/nxjbill/article/details/78160167
https://stackoverflow.com/questions/38994306/what-is-the-meaning-of-0x61c88647-constant-in-threadlocal-java
https://github.com/gp0/cod4stats/blob/master/src/codmpdatadec.c
http://machbbs.com/52pojie/28773
Unfortunately I cannot confirm the exact variation of the algorithm that uses these constants.
Here you can see asm source code https://pastebin.com/eLm8bw31
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels