Nowadays, Android has become the most widely used platform for smartphones. Due to the active used of smartphones, the floodgates of mobile malware threats are open every single day. Mobile malware harms users by illegally disable a mobile device, allowing malicious user to remotely control the device and steal personal information stored on the device. One of the surveillance features that attackers could abuse to gain those benefits is by exploiting the SMS message. Therefore, this paper introduces a new system call classification for SMS exploitation using a covering algorithm. The new system call classification can be used as a guidance to defend against mobile malware attacks. 1260 malware samples related to SMS exploitation from the Android Malware Genome Project have been analysed. The experiment was conducted using the dynamic analysis and open source tools in a controlled lab environment. � Springer International Publishing Switzerland 2016.