ACTAndroid C2 Tracker

c0369bb01302639674a3178e…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Korean Spyware (provisional). South Korean SMS/call/location spyware (package com.ouah08.ouah_08_17[_n], main activity user_info). It uploads victim data via api.send_post (HttpURLConnection) to http://cocoam.co.kr/api/ and files via cm.HttpFileUpload to /mobile/, and receives commands over Google Cloud Messaging. The live C2 is selected in cm.onCreate by comparing build resource string 0x7f040000 (baked value real) against an obfuscated constant that also decodes to real, so the shipped build uses cocoam.co.kr; the alternate testcocoa.com endpoint is the test fallback and is not reached at runtime. Samples observed 2014–2017. Provisional bucket pending formal attribution; distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad. Indicators: http://cocoam.co.kr/api/.

Recovered configuration

api_url
http://cocoam.co.kr/api/
c2_host
cocoam.co.kr
img_url
http://cocoam.co.kr/mobile/
package
com.ouah08.ouah_08_17
test_fallback
testcocoa.com (runtime-overridden, unused)
transport
GCM + HttpURLConnection

Identification

SHA-256
c0369bb01302639674a3178e149b5ca018bff4c6c75e3a9c00b4e07fe185f5e0
MD5
36f02528323f169d106173aa14b352e4

Observed

Families
Korean Spyware (provisional)
First seen
2015-07-03

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

IndicatorTypePortSchemeFamilyFirst seen
cocoam.co.kr/api/ domain - http Korean Spyware (provisional) 2015-07-03

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Korean Spyware (provisional)

South Korean SMS/call/location spyware (package com.ouah08.ouah_08_17[_n], main activity `user_info`). It uploads victim data via `api.send_post` (HttpURLConnection) to `http://cocoam.co.kr/api/` and files via `cm.HttpFileUpload` to `/mobile/`, and receives commands over Google Cloud Messaging. The live C2 is selected in `cm.onCreate` by comparing build resource string 0x7f040000 (baked value `real`) against an obfuscated constant that also decodes to `real`, so the shipped build uses cocoam.co.kr; the alternate `testcocoa.com` endpoint is the test fallback and is not reached at runtime. Samples observed 2014–2017. Provisional bucket pending formal attribution; distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad.