Java.Boxer

The Trojan arrives as a java application that requires the user to install manually and run.

Once executed, the Trojan accesses the following file which carries a list of premium rate phone numbers inside its Java Archive:
load.bin

It loads and decrypts the numbers and the text to be sent and proceeds to send SMS text messages to premium rate phone numbers.

The user may be asked to grant text sending permissions to the application, depending on the platform policies of the mobile device.

Summary