https://t.me/+8vGCuuF3ANY0ZjA1

url not resolving

Tracked by C2 Tracker · Whois queried never

Network

Network: -
CIDR: -
Country: -

Contact

Handle: -
Abuse: -

Observed in malware

Family	Sample SHA-256	Role	First seen
SpBoy Loader (provisional)	fc66bbb945a9…	C2	2026-10-08

About SpBoy Loader (provisional)

**SpBoy Loader (provisional)** is a license/key-gated Android loader (package `com.spboy.panel`, code under `com.paramod`). It fetches configuration and verifies a key against a config server over HTTPS before activating: `com.paramod.KeyUpdate` and `KeyGate` call `HttpURLConnection` against `/api/config` and `/api/verify` on the C2. It ships a native anti-tamper component (`libSignatureKiller.so`) and sideloads a bundled `assets/SignatureKiller/origin.apk`. Resolving IPs are Cloudflare fronting (onrender free hosting), not direct C2. Shares a signing certificate with the VeyoTV Loader and WebSocket VNC Banker samples (same actor).