J2ME/Agent.C

J2ME/Agent.C arrives as a JAR installation package for an application named “SexP” that poses as an application for porn services. 

It affects all devices that support J2ME or Java Midlet execution. 

 Upon installation, it will then appear in the phone as follows with an Application name “SexPicture”:

 It drops the following components:

a.class

b.class

c.class

d.class

SexPicture.class

b.class handles the SMS sending functionalities for this Trojan.

Upon execution of the malicious application, it will show the following:

 Accepting it will display the following message, instructing the user to repeatedly click the ok to enlarge the image:

 
The malicious app may then prompt the following message that will allow it to send an SMS to 7122, 5373, 7132, and 6008.  However since the user is continuously clicking OK, this message will come unnoticed. The compromised user may also be charged at premium rates for these messages.

 Manual Disinfection

1. Go to the device’s Application Manager and remove/uninstall applications named “SexP”. 
2. Scan your mobile device using UMU Scan and delete all files detected as J2ME/Agent.C