Pegasus for Android
eatsvTG
eatsvTG
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Persistence, Evasion, and Suicide Functionality<br />
Suicide Functionality<br />
As seen in the iOS version of <strong>Pegasus</strong>, the <strong>Android</strong> counterpart also includes suicide<br />
functionality to remove itself under a variety of different circumstances. Our analysis identified<br />
the following four cases where this functionality would be triggered:<br />
1. The MCC subscribe ID does not exist or is invalid<br />
2. An antidote file exists at /sdcard/MemosNoteNotes<br />
3. <strong>Pegasus</strong> <strong>for</strong> <strong>Android</strong> has not checked in with the servers <strong>for</strong> more than 60 days<br />
4. <strong>Pegasus</strong> <strong>for</strong> <strong>Android</strong> receives a remote command to remove itself<br />
MCC Subscriber ID Suicide<br />
It appears that <strong>Pegasus</strong> <strong>for</strong> <strong>Android</strong> will kill itself if it is unable to detect the MCC subscriber ID<br />
or finds it to be invalid. This is likely to prevent it from being run on test devices and emulator<br />
environments which may not be connected to a cellular network. The analyzed sample<br />
appeared to contain (what is presumably) test code that allows it to run regardless of whether it<br />
detects the device is connected to a cellular network or not.<br />
Existence of Antidote File<br />
If a file is present at /sdcard/MemosForNotes then <strong>Pegasus</strong> <strong>for</strong> <strong>Android</strong> will clean up and<br />
remove itself from the device.<br />
25
Change language