@infosec_jcp 🆓🐦🐈🃏 done differently · @infosec_jcp
253 followers · 1356 posts · Server infosec.exchangeTrapped & Traced #GammsGroup #FinFisher 03-13-2023 from new AT&T Motorola Phone under ~$100 🔎☣️🤳👀👀🔍
¹ From Virus Total Scanner:
https://www.virustotal.com/en/file/9b53e0eeb35c173fd0c56b85812c0e59501a8588037dc92b8bac38e916ffdf09/analysis/ #VisualVoicemail
GammaGroup.com Visual voicemail FinFisher Module 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g806efa51f1af4a638b20262b6931f8b0caab56f276834ca58b01afcc4605057e
² From Virus Total Scanner:
https://www.virustotal.com/en/file/5387c9d5a137908cdc7820af51fea018c7b96dcce08a32a1fc20e9b6e64c8738/analysis/ #CarrierHub
GammaGroup From FinFisher CarrierHub 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g13901560905741e48e926e061e01252bfa4ff6e8255f4156b56ca739c4ecaff3
³ From Virus Total Scanner:
https://www.virustotal.com/en/file/433321001cb907c775e4a06c1a2e36861b0d0355a74b4b9d0d1c2e48cce55d4c/analysis/ #MCMClient
GammaGroup FinFisher Module MCMClient 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/gf312aa3fc4174d9b88355ad755e6f24522e795ee3a304d3db07bb0ec7daa702b
⁴ From Virus Total Scanner:
https://www.virustotal.com/en/file/ae22b44ad5381463912046aea7ec541352e22b02f2f0887864807b22473c92ca/analysis/ #MTPHost 📬 Gmail backdoor Client
GammaGroup FinFisher Module MTPHost 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g2579d64499654488a367fc14de7457bb6cd1b7489d0840cf8e0b61baa1d96bd6
⁵
From Virus Total Scanner:
https://www.virustotal.com/en/file/727ed61fe7e6476a4a7e08fcc16447fb74f6df317ea16f483efcf3da709cd4ba/analysis/ #MobileInstaller
GammaGroup FinFisher Module MobileInstaller 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g5af535a69bba4ad6a8db6866f9e46075d42e2e8e0b424cfb93ec7bd473ff2180
⁶ From Virus Total Scanner:
https://www.virustotal.com/en/file/87b87fc66535c3415bffd4cd34c48d67054b9b4b90c4092fa535cb45ed5a0f41/analysis/ #InvisibleNet Motorola
GammaGroup FinFisher Module InvisibleNet 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g01fa7fb9fb744f0d903e473bcd5fbad0a079d61992144621852170d09a81b6c9
⁷ #GammaGroup #FinFisher #FinSpy #Finsky #infosec #detectionkit for #Android apps list & tools involved
¹ Firewall AI -🔎 Blocking / Host Lists 🔍
² VirusTotal App 🔎🤳💻☣️🔍
³ VirusTotal Forensics ENV Read-Only Account 🔎☣️🔍
⁴ PCAPdroid App - PCAP files / Host Lists 🔎🗒️🔍
⁵ Textpad or Text file editor - 🔎📝🔍
⁶ Web2 + Web3 posting 👨💻👩💻💻🖥️💿💾🖨️👀🎧👂
#SSM™ #StateSponsoredMalware™ #investigations by #infosec_jcp
#gammsgroup #finfisher #visualvoicemail #carrierhub #mcmclient #mtphost #mobileinstaller #InvisibleNET #gammagroup #finspy #Finsky #infosec #detectionkit #android #ssm #statesponsoredmalware #investigations #infosec_jcp
@infosec_jcp 🆓🐦🐈🃏 done differently · @infosec_jcp
253 followers · 1356 posts · Server infosec.exchangeTrapped & Traced #GammsGroup #FinFisher 03-13-2023 from new AT&T Motorola Phone under ~$100 🔎☣️🤳👀👀🔍
¹ From Virus Total Scanner:
https://www.virustotal.com/en/file/9b53e0eeb35c173fd0c56b85812c0e59501a8588037dc92b8bac38e916ffdf09/analysis/ #VisualVoicemail
GammaGroup.com Visual voicemail FinFisher Module 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g806efa51f1af4a638b20262b6931f8b0caab56f276834ca58b01afcc4605057e
² From Virus Total Scanner:
https://www.virustotal.com/en/file/5387c9d5a137908cdc7820af51fea018c7b96dcce08a32a1fc20e9b6e64c8738/analysis/ #CarrierHub
GammaGroup From FinFisher CarrierHub 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g13901560905741e48e926e061e01252bfa4ff6e8255f4156b56ca739c4ecaff3
³ From Virus Total Scanner:
https://www.virustotal.com/en/file/433321001cb907c775e4a06c1a2e36861b0d0355a74b4b9d0d1c2e48cce55d4c/analysis/ #MCMClient
GammaGroup FinFisher Module MCMClient 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/gf312aa3fc4174d9b88355ad755e6f24522e795ee3a304d3db07bb0ec7daa702b
⁴ From Virus Total Scanner:
https://www.virustotal.com/en/file/ae22b44ad5381463912046aea7ec541352e22b02f2f0887864807b22473c92ca/analysis/ #MTPHost 📬 Gmail backdoor Client
GammaGroup FinFisher Module MTPHost 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g2579d64499654488a367fc14de7457bb6cd1b7489d0840cf8e0b61baa1d96bd6
⁵
From Virus Total Scanner:
https://www.virustotal.com/en/file/727ed61fe7e6476a4a7e08fcc16447fb74f6df317ea16f483efcf3da709cd4ba/analysis/ #MobileInstaller
GammaGroup FinFisher Module MobileInstaller 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g5af535a69bba4ad6a8db6866f9e46075d42e2e8e0b424cfb93ec7bd473ff2180
⁶ From Virus Total Scanner:
https://www.virustotal.com/en/file/87b87fc66535c3415bffd4cd34c48d67054b9b4b90c4092fa535cb45ed5a0f41/analysis/ #InvisibleNet Motorola
GammaGroup FinFisher Module InvisibleNet 03-13-2023
New VT generated after Save:
https://www.virustotal.com/graph/embed/g01fa7fb9fb744f0d903e473bcd5fbad0a079d61992144621852170d09a81b6c9
⁷ #GammaGroup #FinFisher #FinSpy #Finsky #infosec #detectionkit for #Android apps list & tools involved
¹ Firewall AI -🔎 Blocking / Host Lists 🔍
² VirusTotal App 🔎🤳💻☣️🔍
³ VirusTotal Forensics ENV Read-Only Account 🔎☣️🔍
⁴ PCAPdroid App - PCAP files / Host Lists 🔎🗒️🔍
⁵ Textpad or Text file editor - 🔎📝🔍
⁶ Web2 + Web3 posting 👨💻👩💻💻🖥️💿💾🖨️👀🎧👂
#gammsgroup #finfisher #visualvoicemail #carrierhub #mcmclient #mtphost #mobileinstaller #InvisibleNET #gammagroup #finspy #Finsky #infosec #detectionkit #android
@infosec_jcp 🆓🐦🐈🃏 done differently · @infosec_jcp
241 followers · 1139 posts · Server infosec.exchange
Today I got four more IP's from four different IP ranges calling back as #System app from a #GammaGroup #FinFisher #FinSpy #Finsky desperately trying to reach 🔎 #Google's, #AWS , #Twitter and another #CloudFront (not shown).🔍🧙♂️🤔
Edit: See attached direct IPs and FQDNs. ☣️
So desperate this #CarrierHub #SSM™ #malware #UIUX #infosec #DetectionWithoutSoftware 👀👀 #ForcedMDM demo
#system #gammagroup #finfisher #finspy #Finsky #google #aws #twitter #cloudfront #carrierhub #ssm #malware #uiux #infosec #detectionwithoutsoftware #forcedmdm
@infosec_jcp 🆓🐦🐈🃏 done differently · @infosec_jcp
241 followers · 1132 posts · Server infosec.exchangeToday I got four more IP's from four different IP ranges calling back as #System app from a #GammaGroup #FinFisher #FinSpy #Finsky desperately trying to reach 🔎 #Google's, #AWS , #Twitter and another #CloudFront (not shown).🔍🧙♂️🤔
Edit: See attached direct IPs and FQDNs. ☣️
So desperate this #CarrierHub #SSM™ #malware #UIUX #infosec #DetectionWithoutSoftware 👀👀 demo
#system #gammagroup #finfisher #finspy #Finsky #google #aws #twitter #cloudfront #carrierhub #ssm #malware #uiux #infosec #detectionwithoutsoftware
@infosec_jcp 🆓🐦🐈🃏 done differently · @infosec_jcp
239 followers · 1115 posts · Server infosec.exchange#GammaGroup.Com
#FinFisher #FinSpy #Finsky
App : #CarrierHub : #ForcedMDM
☣️ IP 142.250.68.42 ☣️
#VirusTotal'D
https://www.virustotal.com/graph/embed/g2d788ed91ba84968ad15971054394ec2dc7697e15e3442b9b43c74667702b4e2?theme=light
#gammagroup #finfisher #finspy #Finsky #carrierhub #forcedmdm #virustotal