0d3182cb6488a2657e2bbc94…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

QinYue SMS Stealer (provisional). QinYue SMS Stealer (provisional) is an Android SMS/data-exfil trojan (package com.qinyue.vmain) that harvests a victim’s text messages, contact lists and photos and uploads them to an HTTP C2. The endpoints are plaintext in com.qinyue.vmain.activity.Urls and are called with the rxhttp (OkHttp) client: POST /api/register (device registration, sends BRAND-MODEL), POST /api/subList (contact/subscriber list), POST /api/subSmsList (SMS exfil) and POST /api/uploadImgs (image upload). Statically recovered from the readable dex. Indicators: http://120.24.226.6:16539.

Recovered configuration

endpoints

POST /api/register (device reg), POST /api/subList (contacts/list), POST /api/subSmsList (SMS exfil), POST /api/uploadImgs (image upload)

source_to_sink

com.qinyue.vmain.activity.Urls.{register,upLoadList,upLoadSms,upLoadImg}='http://120.24.226.6:16539/api/{register,subList,subSmsList,uploadImgs}'. LoginActivity calls RxHttp.postForm(Urls.register,...).add(phone,code,data=BRAND-MODEL), RxHttp.postJson(Urls.upLoadList/upLoadSms, json), RxHttp.postForm(Urls.upLoadImg,...).addFile('file',..) -> rxhttp/OkHttp real POST sinks.

Identification

SHA-256: 0d3182cb6488a2657e2bbc94dd1aab6bec95a78b37049b7b149e247af82fb458
MD5: a936e253df38db538cecc5aa177640a3

Observed

Families: QinYue SMS Stealer (provisional)
First seen: 2026-10-13

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
120.24.226.6	ip	16539	http	QinYue SMS Stealer (provisional)	2026-10-13

Signing certificate

Subject CN: Android
Issuer CN: -
Fingerprint: 475bc46d5d521575d0069036584d4418e282ab69c7c3983797776f8d9cde2c6d

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About QinYue SMS Stealer (provisional)

**QinYue SMS Stealer (provisional)** is an Android SMS/data-exfil trojan (package `com.qinyue.vmain`) that harvests a victim's text messages, contact lists and photos and uploads them to an HTTP C2. The endpoints are plaintext in `com.qinyue.vmain.activity.Urls` and are called with the **rxhttp** (OkHttp) client: `POST /api/register` (device registration, sends BRAND-MODEL), `POST /api/subList` (contact/subscriber list), `POST /api/subSmsList` (SMS exfil) and `POST /api/uploadImgs` (image upload). Statically recovered from the readable dex.