Pegasus for Android

Default Calendar
content://com.android.calendar/events
content://calendar/events
Live Audio Surveillance
Pegasus for Android supports live audio surveillance. This functionality is triggered when a call
is received from an attacker’s specified number and results in an adversary being able to silently
listen and capture surrounding audio received by the device’s microphone. Live audio
surveillance functionality can only be activated in specific situations that require the following
conditions to be met:
● The screen is locked
● The screen is off
● Call forwarding is not enabled
● A user did not interrupt a previous live surveillance operation
● There is no approved live surveillance endpoint to accept calls from
● The calling number must match the decrypted value stored in shared preferences under
the key “​Skypi​”
● The telephony state is not idle
● The microphone is not already in use
● If certain battery charging conditions are not met
● A wired headset is not connected
● A bluetooth A2DP audio peripheral is not connected
● Communication is not currently using bluetooth
● Music is not active
● The device is either not roaming or Pegasus has been configured to perform this
functionality even if a device is roaming
Screenshot and Camera Capability
Pegasus for Android contains the functionality to capture visual content via screenshots or by
using a device’s front or back camera.
In order to successfully function regardless of a device’s operating environment, analysis
showed that screen capture capability was implemented twice. The first approach that Pegasus
for Android uses relies on the ​screencap​ binary which exists on some installations under the
/system/bin/​ path. If present, Pegasus for Android instructs it to take a screenshot and save
it in the PNG file format to​ /data/data/com.network.android/bqul4.dat​. This
functionality can be seen in the following screenshot.
21