Java/Swapi.AF!tr

description-logoAnalysis

Java/Swapi.AF!tr is a variant of Java/Swapi.E!tr. It affects most mobile phones which support Java, and attempts to send SMS messages (at the victim's expense).
Similarly to Java/Swapi.B!tr it reads a resource file from which it decodes the SMS short code and text to send.


Technical Details


This variant supports Samsung and Siemens proprietary Java APIs to send SMS messages. Consequently, the malware successfully sends SMS messages on:
  • any mobile phone supporting the WMA API (JSR 120) - most phones do support this
  • Samsung phones with the com.samsung.util.SMS API
  • Siemens phones with the com.siemens.mp.gsm.SMS
Moreover, the malware memorizes in the midlet's private record store the number of times the malware has been run.

recommended-action-logoRecommended Action

    FortiGate Systems
  • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.
    FortiClient Systems
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiClient
Extreme
FortiMail
Extreme
FortiSandbox
Extreme
FortiWeb
Extreme
Web Application Firewall
Extreme
FortiIsolator
Extreme
FortiDeceptor
Extreme
FortiEDR