c0369bb01302639674a3178e…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Korea-Hosted Spyware (provisional). Korea-Hosted Spyware (provisional) is an Android surveillance tool (package com.ouah08.ouah_08_17[_n], main activity user_info) that harvests GPS/assisted-GPS location, SMS, call and phone state, and account data, uploading it via api.send_post (HttpURLConnection) to http://cocoam.co.kr/api/ and files via cm.HttpFileUpload to /mobile/, with commands delivered over Google Cloud Messaging. The live C2 is selected in cm.onCreate by comparing build resource 0x7f040000 (baked value real) against an obfuscated constant that also decodes to real, so the shipped build uses cocoam.co.kr; the testcocoa.com endpoint is a test fallback that is runtime-overridden and not reached. The name reflects infrastructure and apparent victim focus only - the live C2 is hosted on a South Korean .co.kr domain and the samples appear aimed at Korean users - and is NOT an attribution of authorship or origin; the operator is unknown. Samples observed 2014-2017. Distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad. Indicators: http://cocoam.co.kr/api/.

Recovered configuration

api_url

http://cocoam.co.kr/api/

c2_host

cocoam.co.kr

img_url

http://cocoam.co.kr/mobile/

package

com.ouah08.ouah_08_17

test_fallback

testcocoa.com (runtime-overridden, unused)

transport

GCM + HttpURLConnection

Identification

SHA-256: c0369bb01302639674a3178e149b5ca018bff4c6c75e3a9c00b4e07fe185f5e0
MD5: 36f02528323f169d106173aa14b352e4

Observed

Families: Korea-Hosted Spyware (provisional)
First seen: 2015-07-03

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
cocoam.co.kr/api/	domain	-	http	Korea-Hosted Spyware (provisional)	2015-07-03

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Korea-Hosted Spyware (provisional)

**Korea-Hosted Spyware (provisional)** is an Android surveillance tool (package `com.ouah08.ouah_08_17[_n]`, main activity `user_info`) that harvests GPS/assisted-GPS location, SMS, call and phone state, and account data, uploading it via `api.send_post` (HttpURLConnection) to `http://cocoam.co.kr/api/` and files via `cm.HttpFileUpload` to `/mobile/`, with commands delivered over Google Cloud Messaging. The live C2 is selected in `cm.onCreate` by comparing build resource 0x7f040000 (baked value `real`) against an obfuscated constant that also decodes to `real`, so the shipped build uses cocoam.co.kr; the `testcocoa.com` endpoint is a test fallback that is runtime-overridden and not reached. The name reflects infrastructure and apparent victim focus only - the live C2 is hosted on a South Korean `.co.kr` domain and the samples appear aimed at Korean users - and is NOT an attribution of authorship or origin; the operator is unknown. Samples observed 2014-2017. Distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad.