Mobile malware is ubiquitous in many malicious activities such as money stealing. Consumers are charged without their consent. This paper explores how mobile malware exploit the system calls via SMS. As a solution, we proposed a system calls classification based on surveillance exploitation system calls for SMS. The proposed system calls classification is evaluated and tested using applications from Google Play Store. This research focuses on Android operating system. The experiment was conducted using Drebin dataset which contains 5560 malware applications. Dynamic analysis was used to extract the system calls from each application in a controlled lab environment. This research has developed a new mobile malware classification for Android smartphone using a covering algorithm. The classification has been evaluated in 500 applications and 126 applications have been identified to contain malware. � Springer International Publishing AG 2017.