0fa558d36ad5bbd7a9165ddc…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

SpBoy Loader (provisional). SpBoy Loader (provisional) is a license/key-gated Android loader (package com.spboy.panel, code under com.paramod). It fetches configuration and verifies a key against a config server over HTTPS before activating: com.paramod.KeyUpdate and KeyGate call HttpURLConnection against /api/config and /api/verify on the C2. It ships a native anti-tamper component (libSignatureKiller.so) and sideloads a bundled assets/SignatureKiller/origin.apk. Resolving IPs are Cloudflare fronting (onrender free hosting), not direct C2. Shares a signing certificate with the VeyoTV Loader and WebSocket VNC Banker samples (same actor). Indicators: https://proxy-90bc.onrender.com:443.

Recovered configuration

endpoints

GET /api/config?v=15, /api/verify (programmatic HttpURLConnection); /getkey and site root are button click-throughs (display).

source_to_sink

com.paramod.KeyUpdate: new URL('https://proxy-90bc.onrender.com/api/config?v=15').openConnection() HttpURLConnection; com.paramod.KeyGate: URL('https://proxy-90bc.onrender.com/api/verify').openConnection(). Real HTTP sinks (config/license fetch).

Identification

SHA-256: 0fa558d36ad5bbd7a9165ddcdd490f5349341c406ab0d208c2ad773bba4849c9
MD5: aa6513b25bda2da7b38c9d769599c8cc

Observed

Families: SpBoy Loader (provisional)
First seen: 2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
proxy-90bc.onrender.com	domain	443	https	SpBoy Loader (provisional)	2026-10-13

Signing certificate

Subject CN: Android
Issuer CN: -
Fingerprint: a40da80a59d170caa950cf15c18c454d47a39b26989d8b640ecd745ba71bf5dc

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About SpBoy Loader (provisional)

**SpBoy Loader (provisional)** is a license/key-gated Android loader (package `com.spboy.panel`, code under `com.paramod`). It fetches configuration and verifies a key against a config server over HTTPS before activating: `com.paramod.KeyUpdate` and `KeyGate` call `HttpURLConnection` against `/api/config` and `/api/verify` on the C2. It ships a native anti-tamper component (`libSignatureKiller.so`) and sideloads a bundled `assets/SignatureKiller/origin.apk`. Resolving IPs are Cloudflare fronting (onrender free hosting), not direct C2. Shares a signing certificate with the VeyoTV Loader and WebSocket VNC Banker samples (same actor).