Korea-Hosted Spyware (provisional)

Korea-Hosted Spyware (provisional) is an Android surveillance tool (package com.ouah08.ouah_08_17[_n], main activity user_info) that harvests GPS/assisted-GPS location, SMS, call and phone state, and account data, uploading it via api.send_post (HttpURLConnection) to http://cocoam.co.kr/api/ and files via cm.HttpFileUpload to /mobile/, with commands delivered over Google Cloud Messaging. The live C2 is selected in cm.onCreate by comparing build resource 0x7f040000 (baked value real) against an obfuscated constant that also decodes to real, so the shipped build uses cocoam.co.kr; the testcocoa.com endpoint is a test fallback that is runtime-overridden and not reached. The name reflects infrastructure and apparent victim focus only - the live C2 is hosted on a South Korean .co.kr domain and the samples appear aimed at Korean users - and is NOT an attribution of authorship or origin; the operator is unknown. Samples observed 2014-2017. Distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad.