001ba8384c75f9f27e1a8316…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Korea-Hosted Spyware (provisional). Korea-Hosted Spyware (provisional) is an Android surveillance tool (package com.ouah08.ouah_08_17[_n], main activity user_info) that harvests GPS/assisted-GPS location, SMS, call and phone state, and account data, uploading it via api.send_post (HttpURLConnection) to http://cocoam.co.kr/api/ and files via cm.HttpFileUpload to /mobile/, with commands delivered over Google Cloud Messaging. The live C2 is selected in cm.onCreate by comparing build resource 0x7f040000 (baked value real) against an obfuscated constant that also decodes to real, so the shipped build uses cocoam.co.kr; the testcocoa.com endpoint is a test fallback that is runtime-overridden and not reached. The name reflects infrastructure and apparent victim focus only - the live C2 is hosted on a South Korean .co.kr domain and the samples appear aimed at Korean users - and is NOT an attribution of authorship or origin; the operator is unknown. Samples observed 2014-2017. Distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad. Indicators: http://cocoam.co.kr/api/.

Recovered configuration

package

com.ouah08.ouah_08_17_n

Identification

SHA-256: 001ba8384c75f9f27e1a831621f61a0e84492958d4c1ce885feab812ab824bbb
MD5: 42dcd600444dda18185b86e66544afe8

Observed

Families: Korea-Hosted Spyware (provisional)
First seen: 2014-06-12

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
cocoam.co.kr/api/	domain	-	http	Korea-Hosted Spyware (provisional)	2014-06-12

Signing certificate

Subject CN: -
Issuer CN: -
Fingerprint: 419332188121a5d656e7639d8a01b47f7a1343178d86894729265515d5b466f4

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Korea-Hosted Spyware (provisional)

**Korea-Hosted Spyware (provisional)** is an Android surveillance tool (package `com.ouah08.ouah_08_17[_n]`, main activity `user_info`) that harvests GPS/assisted-GPS location, SMS, call and phone state, and account data, uploading it via `api.send_post` (HttpURLConnection) to `http://cocoam.co.kr/api/` and files via `cm.HttpFileUpload` to `/mobile/`, with commands delivered over Google Cloud Messaging. The live C2 is selected in `cm.onCreate` by comparing build resource 0x7f040000 (baked value `real`) against an obfuscated constant that also decodes to `real`, so the shipped build uses cocoam.co.kr; the `testcocoa.com` endpoint is a test fallback that is runtime-overridden and not reached. The name reflects infrastructure and apparent victim focus only - the live C2 is hosted on a South Korean `.co.kr` domain and the samples appear aimed at Korean users - and is NOT an attribution of authorship or origin; the operator is unknown. Samples observed 2014-2017. Distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad.