Threat Research · Malware Analysis
Manuel Boll
Security research driven by curiosity: I reverse-engineer malware, analyze the traces it leaves, and publish what I find. No vendor spin, no recycled headlines — just hands-on work with real samples and real data.
Research & Write-ups
Latest Posts
TeleShim: Static Analysis of an ASUS-Masquerading Sideloader with Telegram C2
Beginner-friendly Malcat walkthrough of a 32-bit sideloader that pretends to be a task-scheduler helper for ASUS, hides its config as base64 wrapped in a circular XOR, and uses api.telegram.org as its command channel. Covers the summary view, section entropy, exports, strings, anomalies, config decryption, and the getUpdates/sendMessage/sendDocument flow — all statically, without ever executing the sample.
Reversing a Big-Endian MIPS Mirai Variant: A Beginner’s Static-Analysis Walkthrough
Beginner-friendly walkthrough of a MIPS Mirai/CondiBot variant called ohshit.mips: decoding the single-byte XOR strings, mapping a 21-slot function pointer table that turns out to be mostly unrelated to the C2 attack vocabulary, and tracing how genddos.st ends up as a DNS amplification payload instead of a C2 domain.
Spotify Playlists as Malware Infrastructure: An Analysis of 41 Samples
How 41 malware samples ended up in the Spotify contacted-URL logs on VirusTotal — and why one of them was hiding its configuration in a playlist name.
Monitoring Stealer Exfiltration at Scale: Turning Telegram Bot Tokens into Threat Intelligence
A stealer needs somewhere to send the loot. Renting a VPS and standing up a panel is the textbook answer; embedding a Telegram bot token is the lazy one. It costs nothing, the transport is TLS, …
Extending SubCrawl: Rebuilt MISP Storage and Real-Time Teams Alerting
SubCrawl from HP Threat Research is a fine bit of engineering: it crawls open directories, fingerprints what it finds against YARA and ClamAV, tags it against URLhaus and hands the results off to a …
Beyond the Blog
Data & Feeds
Read-only REST API
Telegram Threat-Intelligence Feed
Structured intelligence on Telegram bots abused by malware — bot tokens, chat IDs and campaign context, collected daily from live samples. Access for vetted partners.
Request accessOpen Data
Datasets from the Research
Exports and datasets behind the write-ups, free to download and reuse for your own analysis. Sharing is caring.
Browse the data