https://t.me/imnovatm
urlTracked by C2 Tracker · Whois queried never
Network
- Network
- -
- CIDR
- -
- Country
- -
Contact
- Handle
- -
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| SpBoy Loader (provisional) | f1ff7f2f5969… | C2 | 2026-10-13 |
About SpBoy Loader (provisional)
**SpBoy Loader (provisional)** is a license/key-gated Android loader (package `com.spboy.panel`, code under `com.paramod`). It fetches configuration and verifies a key against a config server over HTTPS before activating: `com.paramod.KeyUpdate` and `KeyGate` call `HttpURLConnection` against `/api/config` and `/api/verify` on the C2. It ships a native anti-tamper component (`libSignatureKiller.so`) and sideloads a bundled `assets/SignatureKiller/origin.apk`. Resolving IPs are Cloudflare fronting (onrender free hosting), not direct C2. Shares a signing certificate with the VeyoTV Loader and WebSocket VNC Banker samples (same actor).