ACTAndroid C2 Tracker

dd3b7e2e5cccc83e6dced0b3…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Premium Panel Fraud. Free Fire game top-up / “follower” panel fraud apps (pkg com.premiumPanel.follower), built with Sketchware. No custom C2 server: a Firebase Realtime Database project is the entire serverless backend. RTDB nodes: Price (product catalog shown in MainActivity), Normal (pending-order queue - each order stores the device id, price, time/date, buyer name and a ‘Tock’ token, status “Pending…..”), DONE (fulfilled orders), and Report (ReportActivity writes the device id via getDeviceId()/android_id plus a free-text complaint). PayActivity collects payment through a live Razorpay checkout key and a UPI QR (generated via quickchart.io), writes the order to Normal, then fires an FCM push to the operator. Promoted via Telegram/YouTube (Follower666FF). Not a RAT/spyware: requests only internet/storage/overlay/FCM, no SMS/contacts/location/accessibility, and performs no device control or bulk exfil. Notable: each APK hardcodes the project’s Firebase Admin SDK service-account PRIVATE KEY in PayActivity (to send FCM), which leaks full administrative control of the operator’s Firebase project. Observed backends: getaway-payment-2026final, september-premium-panel2026. Indicators: firebase://getaway-payment-2026final.

Recovered configuration

app_class
.SketchApplication (Sketchware)
components
MainActivity, PayActivity, ReportActivity, AutoActivity, DebugActivity + FCM services
features
Free Fire top-up/follower 'panel' app. Firebase RTDB = serverless order backend: nodes Price (catalog), Normal (pending orders: Device id, Price, Time, Date, Stu=Pending, name, Tock token), DONE (fulfilled), Report (device id + user complaint). PayActivity takes payment via live Razorpay checkout + UPI QR (quickchart) then writes the order to Normal and pushes an FCM notification to the operator. ReportActivity harvests device id (getDeviceId/android_id). No SMS/contacts/location/accessibility -> fraud infra, not spyware. CRITICAL: APK hardcodes the Firebase Admin SDK service-account PRIVATE KEY (full RSA) in PayActivity to send FCM — leaks full admin control of the operator's Firebase project.
firebase_rtdb_nodes
Price, Normal, DONE, Report
package
com.premiumPanel.follower
promo
telegram.me/Follower666FF, youtube @Follower666FF
razorpay_live_key
rzp_live_TUrxEOZBzdZUU6

Identification

SHA-256
dd3b7e2e5cccc83e6dced0b36b7c77de6fcb3564acfaa20abc3735516f6c189b
MD5
793c9fc4f66544b55fa9b0f455f2093b

Observed

Families
Premium Panel Fraud
First seen
2026-09-19

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
getaway-payment-2026final firebase-project - firebase Premium Panel Fraud 2026-09-19

⚠ Embedded admin credential

A Firebase Admin SDK service-account private key is hardcoded in this APK (used by the app to send FCM). It grants full administrative control of the operator's own Firebase project — a takedown / key-revocation lever. It is shown here exactly as it ships inside the distributed malware.

⚠ Firebase Admin SDK private key
Firebase project
getaway-payment-2026final
Realtime DB
https://getaway-payment-2026final-default-rtdb.firebaseio.com
Storage bucket
getaway-payment-2026final.firebasestorage.app
Service account
firebase-adminsdk-fbsvc@getaway-payment-2026final.iam.gserviceaccount.com
Private key
present · 16530452cde2ea3e3543a837169d88c3b9dfb0e41c18a63cc7db19971610bc13
Show private key PEM
-----BEGIN PRIVATE KEY-----�§
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCV79GGwCnhl/Nl
eV1NpfF4VrldKhmTqX7daep2nyOv0T20nQku+kjJ8BbaSKJCQ7a3XDJhiNGLlW1u
nT/UnZOqxtGVEjJNF9t/cl3aQPDTrspCxR5pMwLATlmbCDSNPaZGUHn5ehm+5f2E
f1qskJwOxvQ13NmRN+H5MkT3AHGTNQG73VEjvLd0F9j/q26/o5rdtYoXSvKgoKxF
u3fYE8eOPsEEyq0F9GlbEq6IbYvHDtBckKy9YMqehdCqXd8XC2MxOVv2W9/QCNHN
DesZc7i6ijymcwR8w8eT9z3fNRxT4TvYl0VAgByqsg8ZIoflGyx6FRV6244trZ9P
MKwoXH4bAgMBAAECggEADiAsmih2UAtVdXzUUv5SyQnjZ2Krfsz42rN7UOPX5CnV
r+a2WK3HKys9sLpa4XZPe2fdIT49sgvvMuNV6HO616iChavtf3QQP5B1RU+/88yw
WbXVElRcqn4KYbMJf5/MXF+0yVGwPw41u7fJ2zi5uYfgT+DEjv9eTT1n4B0ASXEP
rXgMyGD9LpWAUq6r62Kd9jhh1QDXFNs6owZ2+EevXqj1eljnQs2lCXj+IRWK4J1D
wYmJRTFZXox8w99He64YNv0bY5OcQ/nv+3stMfPsunlxFDOfYbYc78eXZS0cON8w
0lPwFCfV0SXfcY0/e5MJSL12CCt8ys4eEOOg3dzMlQKBgQDS/CybBFoopXvRhBg/
W7EaE7h3ynqcyLtezjrTfA3gScziwpkTjbm88g4QV/lBk7JXXaERTxURy1+ljA/9
O2DgN1Pvn3AncD/vPARpZtXubGbMYI4icVvdD60OX4SUtJiuFBDdEIaxsRJrsu1R
BSgaby46m8dVhQyiSWBYmFuJPwKBgQC17T1Py/9WF5EqdO3EelGaW3HDwCNNQsSp
8isX4jrQvCUbkHZzhe6lkGj4AoC9Bx6LwvUDdVGVB9QfWmOvV5wjC7hJ07wEJqhx
TKN/iUxotziwm6zVyGQLsOKmvtHWH5EgFTQu259+7WnUOV76UG+FXdMEN1nnfQ08
ItzHgwxYJQKBgQCag8w3CwzsT6VKX69SV1hwfJjQQh1hzTBL0kUKtQOEiwfd2h45
T8YDNlJObd9Bw2UMzqky//OyQHsfxl+/WUkta9ew2ddNSsvH7PBeMM3j+seeTehK
GTLpxp06tYFnVouqkU94Vq4OXFvdPADJITmpglsc2RE29GW4RHym5Y3ECQKBgAUQ
NUSjSNf8j+2+k1+EiADjyqbIEjN0SETymIBxq3FjyySZQLK2Z430FvfQGgUozZDW
PDt8aGjdbunwehXHOnE/QkHLws/aw5VjrKlACQBhGRLRQl4w1Zf9tFEvvmdXOZLL
BEjJlAbUVL2zWxFca74qflT/tWDb+iJSVhK3cwCBAoGAYCa7PP1vakyvb/bMgswe
wftYnFzIGau0MfqoTvIKpGMeZHrc8mexFVbyy5H5Xa+3Oo05jo9r+LWEojs0I9Sm
y32RCM5BVKVdO6xrX6110daCBVouXDx/5fooN6Md63Il+Hs/adogzaJeS7VBm94S
hitxGnCvGku/uNLXvyHYxtU=
-----END PRIVATE KEY-----

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Premium Panel Fraud

Free Fire game top-up / "follower" panel fraud apps (pkg com.premiumPanel.follower), built with Sketchware. No custom C2 server: a Firebase Realtime Database project is the entire serverless backend. RTDB nodes: Price (product catalog shown in MainActivity), Normal (pending-order queue - each order stores the device id, price, time/date, buyer name and a 'Tock' token, status "Pending....."), DONE (fulfilled orders), and Report (ReportActivity writes the device id via getDeviceId()/android_id plus a free-text complaint). PayActivity collects payment through a live Razorpay checkout key and a UPI QR (generated via quickchart.io), writes the order to Normal, then fires an FCM push to the operator. Promoted via Telegram/YouTube (Follower666FF). Not a RAT/spyware: requests only internet/storage/overlay/FCM, no SMS/contacts/location/accessibility, and performs no device control or bulk exfil. Notable: each APK hardcodes the project's Firebase Admin SDK service-account PRIVATE KEY in PayActivity (to send FCM), which leaks full administrative control of the operator's Firebase project. Observed backends: getaway-payment-2026final, september-premium-panel2026.