J2ME/Agent.T

J2ME/Agent.T arrives as a JAR installation package for an application named “NaZvAnIe” that poses as an application for porn services. 

It affects all devices that support J2ME or Java Midlet execution. 

Upon installation, it will then appear in the phone as follows with an Application name “NaZvAnIe”:

It drops the following components:

a.class

b.class

c.class

d.class

Main.class

d.class handles the SMS sending functionalities for this Trojan.

Upon execution of the malicious application, it will show the following:

The malicious app may then prompt the following message that will allow it to send an SMS to 5537 and 3121. The compromised user may also be charged at premium rates for these messages.

Manual Disinfection

1. Go to the device’s Application Manager and remove/uninstall applications named “NaZvAnIe”. 
2. Scan your mobile device using UMU Scan and delete all files detected as J2ME/Agent.T