Smshoax

Overview

Trojan:AndroidOS/Smshoax is a prevalent classification of mobile malware specifically designed to commit financial fraud by silently subscribing the victim to premium-rate SMS services or making unauthorized phone calls. While primarily targeting the Android ecosystem, variations exist across mobile platforms. This threat leverages the billing mechanisms of telecommunications carriers, directly draining the victim's prepaid balance or inflating their monthly phone bill.

Understanding SMS Hoax Fraud
To an end-user, the infection is often imperceptible until they receive their monthly phone bill showing exorbitant charges for 'premium text services' or international calls they never made. For security analysts, this represents a highly lucrative, automated monetization scheme. The malware acts as a silent proxy, interacting with carrier billing APIs without the user's knowledge or consent.

Execution and Fraud Mechanics
Smshoax is typically distributed via third-party app stores, disguised as legitimate applications (like games, wallpaper apps, or adult content) (`T1533`). Upon installation (`T1204`), the malware requests excessive permissions, specifically `SEND_SMS`, `READ_SMS`, and `CALL_PHONE` (`T1614.001`). Once granted, it operates in the background. It utilizes its C2 server to receive a list of premium-rate numbers. It then silently sends SMS messages to these numbers (`T1629`). Crucially, to hide its activity from the user, the malware intercepts and immediately deletes the confirmation SMS messages sent back by the premium service or the carrier (`T1562.001`), ensuring the user remains completely unaware they have been subscribed to a recurring, expensive service.

Indicators of Compromise & Impact
The primary impact is direct financial loss for the user. Technical IoCs on the mobile device include an unknown application holding SMS and Phone permissions. Behavioral IoCs include unexpected drops in prepaid mobile balances, unexplained premium charges on phone bills, and the device sending outbound SMS messages to shortcodes (e.g., 5-digit numbers) without user interaction.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SMSHOAX {
    meta:
        description = "Detects Smshoax (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "smshoax" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Smshoax Activity
id: 932ac112e18649dc1287c37b162a0b9d
status: experimental
description: Detects generic indicators of the smshoax malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*smshoax*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately boot the Android device into Safe Mode to prevent third-party applications from running.
2. Navigate to the Application Manager, locate the suspicious app (often the most recently installed game or utility), and uninstall it.
3. Contact the mobile telecommunications carrier immediately to report the fraud, dispute the charges, and request a hard block on all premium-rate SMS billing.
4. Review and revoke excessive permissions (like `SEND_SMS`) for all remaining applications on the device.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore small, unexplained charges on a mobile bill; SMS fraud often starts small to avoid detection before ramping up.
2. Avoid downloading applications from unverified, third-party app stores or side-loading APKs from unknown websites.

References & External Analysis

• Search "smshoax" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Multiinjector
• Yuri
• Spamer
• Sz4Aaw
• Arkeistealer

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/smshoax.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.