september-premium-panel2026
firebase-projectTracked by C2 Tracker · Whois queried never
Network
- Network
- -
- CIDR
- -
- Country
- -
Contact
- Handle
- -
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| Premium Panel Fraud | 0ead8ff84704… | C2 | 2026-09-28 |
| Premium Panel Fraud | da4012520c68… | C2 | 2026-10-12 |
| Premium Panel Fraud | b1983f5c7641… | C2 | 2026-10-13 |
About Premium Panel Fraud
Free Fire game top-up / "follower" panel fraud apps (pkg com.premiumPanel.follower), built with Sketchware. No custom C2 server: a Firebase Realtime Database project is the entire serverless backend. RTDB nodes: Price (product catalog shown in MainActivity), Normal (pending-order queue - each order stores the device id, price, time/date, buyer name and a 'Tock' token, status "Pending....."), DONE (fulfilled orders), and Report (ReportActivity writes the device id via getDeviceId()/android_id plus a free-text complaint). PayActivity collects payment through a live Razorpay checkout key and a UPI QR (generated via quickchart.io), writes the order to Normal, then fires an FCM push to the operator. Promoted via Telegram/YouTube (Follower666FF). Not a RAT/spyware: requests only internet/storage/overlay/FCM, no SMS/contacts/location/accessibility, and performs no device control or bulk exfil. Notable: each APK hardcodes the project's Firebase Admin SDK service-account PRIVATE KEY in PayActivity (to send FCM), which leaks full administrative control of the operator's Firebase project. Observed backends: getaway-payment-2026final, september-premium-panel2026.