J2ME/Agent.S

J2ME/Agent.S arrives as a JAR installation package for an application named “kino” that poses as an application for porn services. 

It affects all devices that support J2ME or Java Midlet execution. 

Upon installation, it will then appear in the phone as follows with an Application name “kino”:

It drops the following components:

a.class

b.class

a.class handles the SMS sending functionalities for this Trojan.

Upon execution of the malicious application, it will show the following:

(“Attention! This appendix contains footage and scenes of an erotic nature. You are 18 years old?”)

The malicious app may then prompt the following message that will allow it to send an SMS to 4460 however since the user is continuously clicking OK, this message will come un-noticed. The compromised user may also be charged at premium rates for these messages.

(“Is processed ... 100% view in full screen. This size: %Percent%”)

After downloading 100%, it will then show the following message:

(“Thank you for such a rapid clicking Ok, now you come SMS with a password to the private site. Clicking on the link you can download a boot. You can go to the site and there perlag.ru password. Either go directly from SMS. Save your address and you no longer have to search for download, everything is on one portal. Access to the archive was paid during the program and you will have agreed to purchase access. Password expiration of one week (7 days).”)

Clicking the right part will prompt for the cellphone to connect to a network:

Manual Disinfection

1. Go to the device’s Application Manager and remove/uninstall applications named “kino”. 
2. Scan your mobile device using UMU Scan and delete all files detected as J2ME/Agent.S