{
  "family": "archsms",
  "sample_count": 127,
  "category": "ransomware",
  "description": "ArchSMS (cataloged across security vendors under designations including Hoax.Win32.ArchSMS, Trojan-Ransom.Win32.ArchSMS, and Trojan:Win32/Archsms) is an infamous financial fraud and extortion ransomware family active since 2010. Researched extensively by Kaspersky and ESET, ArchSMS functions as a 'fake archiver' scam. Cybercriminals package popular freeware, game modifications, media codecs, or pirated software inside a customized executable masquerading as a self-extracting RAR or ZIP archive. When victims launch the archive to extract their desired content, ArchSMS blocks access with an interactive extortion screen claiming the archive is locked for security verification. The application instructs victims to send one or more SMS text messages to designated premium-rate shortcodes to receive an unlock password. In reality, sending the SMS incurs exorbitant charges on the victim's mobile carrier account, while the archive either fails to extract or unpacks corrupted, freely available software.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Hoax.Win32.ArchSMS",
    "Trojan-Ransom.Win32.ArchSMS",
    "Trojan:Win32/Archsms",
    "Ransom:Win32/ArchSMS",
    "Win32/ArchSMS"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the ArchSMS fake archiver family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ArchSMS is a fake self-extracting archive scam that demands users send paid SMS messages to unlock files."
      }
    },
    {
      "@type": "Question",
      "name": "How does ArchSMS defraud victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It instructs users to text premium-rate shortcodes to receive an extraction code, charging excessive fees on mobile bills."
      }
    },
    {
      "@type": "Question",
      "name": "Does sending the SMS unlock the promised files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. The archive typically remains locked or extracts corrupted, useless, or freely available public software."
      }
    },
    {
      "@type": "Question",
      "name": "Where is ArchSMS commonly encountered?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through deceptive torrent portals, warez sites, and fake file-sharing download links."
      }
    },
    {
      "@type": "Question",
      "name": "How should an ArchSMS sample be handled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Never send the SMS message; simply delete the fake archive and run an antivirus scan to remove residual droppers."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2010,
  "motivation": "Extortion",
  "lineage": {
    "derived_from": [
      "Fake Archiver Monetization Architecture",
      "Premium SMS Billing Extortion Stub"
    ],
    "variants": [
      "ArchSMS.A",
      "ArchSMS.B",
      "ArchSMS.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1204.002",
    "T1486",
    "T1036.005",
    "T1547.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1036.005",
      "name": "Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Do not send SMS text messages to any numbers displayed by the fake archive application.",
    "Terminate the fake archiver setup process via Task Manager.",
    "Delete the downloaded fake archive executable (.exe) from the Downloads folder.",
    "Perform an endpoint antivirus scan using Kaspersky or Microsoft Defender to ensure no secondary trojans were dropped."
  ],
  "what_to_avoid": [
    "Do not send SMS verification codes or mobile confirmation numbers to obtain software archive passwords.",
    "Avoid downloading executable archives from unverified file-sharing sites or torrent links."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "threat_actors": [
    "Eastern European Cybercriminal Networks"
  ],
  "target_geographies": [
    "Eastern Europe",
    "Russia",
    "Central Asia",
    "Global"
  ],
  "attack_stage": [
    "extortion",
    "execution",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "iocs": {
    "file_hashes": [
      "a1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3",
      "b2f4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4"
    ],
    "delivery": [
      "Deceptive file-sharing downloads masquerading as software cracks, codecs, or games",
      "Fake self-extracting archive executables hosted on Russian file-hosting platforms"
    ],
    "persistence": [
      "Temporary extraction stubs in %TEMP%",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ArchSMS"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Hoax.Win32.ArchSMS",
      "url": "https://threats.kaspersky.com/en/threat/Hoax.Win32.ArchSMS/"
    },
    {
      "name": "ESET WeLiveSecurity - SMS Ransomware and Fake Archivers",
      "url": "https://www.welivesecurity.com/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}