Pegasus for Android

including an MQTT username, password, and identifying token. The provided token is used to
subscribe to a particular MQTT topic so that the operator can issue device specific commands
that are then executed by that client.
The processing of these remotely issued commands is handled in the same fashion as
instructions received via HTTP and SMS, previously detailed in this report. Each command
includes a signature that is used to verify the authenticity of the command and ensure it is not
only created by the attackers, but that it is intended for the device that is currently processing it.
A separate thread is then responsible for handling the execution of these instructions.
Given that certain device criteria need to be met before certain commands are executed, it is
possible that received commands are not immediately executed. To handle this, Pegasus for
Android has a linked hash set that is used to store pending instructions. At most, 60 pending
instructions can be stored. When full, the receipt of further instructions results in the deletion of
the next instruction to be deleted and the addition of the most recently received one.
Phone Calls
The application has special handling for calls associated with the numbers *762646466 and
*7626464633. These phone numbers, respectively, toggle on and off the ​romingSetted
configuration option which controls whether normal C2 communication is used when the device
is roaming. This feature is likely implemented because when a device is roaming and
romingSetted​ ​is disabled, the application will not accept commands from the normal HTTP,
SMS, or MQTT communications channels.
18