QinYue SMS Stealer (provisional)

QinYue SMS Stealer (provisional) is an Android SMS/data-exfil trojan (package com.qinyue.vmain) that harvests a victim’s text messages, contact lists and photos and uploads them to an HTTP C2. The endpoints are plaintext in com.qinyue.vmain.activity.Urls and are called with the rxhttp (OkHttp) client: POST /api/register (device registration, sends BRAND-MODEL), POST /api/subList (contact/subscriber list), POST /api/subSmsList (SMS exfil) and POST /api/uploadImgs (image upload). Statically recovered from the readable dex.