efa8679360e96bd659ecb6ea…

sample

Tracked by C2 Tracker · indicators & metadata only, the APK itself is never published

Analyst notes

Korean Spyware (provisional). South Korean SMS/call/location spyware (package com.ouah08.ouah_08_17[_n], main activity user_info). It uploads victim data via api.send_post (HttpURLConnection) to http://cocoam.co.kr/api/ and files via cm.HttpFileUpload to /mobile/, and receives commands over Google Cloud Messaging. The live C2 is selected in cm.onCreate by comparing build resource string 0x7f040000 (baked value real) against an obfuscated constant that also decodes to real, so the shipped build uses cocoam.co.kr; the alternate testcocoa.com endpoint is the test fallback and is not reached at runtime. Samples observed 2014–2017. Provisional bucket pending formal attribution; distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad. Indicators: http://cocoam.co.kr/api/.

Recovered configuration

api_url

http://cocoam.co.kr/api/

c2_host

cocoam.co.kr

img_url

http://cocoam.co.kr/mobile/

package

com.ouah08.ouah_08_17_n

test_fallback

testcocoa.com (runtime-overridden, unused)

transport

GCM + HttpURLConnection

Identification

SHA-256: efa8679360e96bd659ecb6ea6d6b38e16dbc7073decf9228a7d6d28dfaf60094
MD5: c818b9470e3216c41a2f11573452ca26

Observed

Families: Korean Spyware (provisional)
First seen: 2017-05-28

C2 configuration (1)

Every indicator extracted from this sample. One row per C2 - each links to its indicator page with Whois, DNS and certificate pivots.

Indicator	Type	Port	Scheme	Family	First seen
cocoam.co.kr/api/	domain	-	http	Korean Spyware (provisional)	2017-05-28

Relationships

Sample → C2 indicators, signing certificate (with every other sample signed by it) and family. Click a node for details, double-click to open its page.

Click a node to inspect it.

About Korean Spyware (provisional)

South Korean SMS/call/location spyware (package com.ouah08.ouah_08_17[_n], main activity `user_info`). It uploads victim data via `api.send_post` (HttpURLConnection) to `http://cocoam.co.kr/api/` and files via `cm.HttpFileUpload` to `/mobile/`, and receives commands over Google Cloud Messaging. The live C2 is selected in `cm.onCreate` by comparing build resource string 0x7f040000 (baked value `real`) against an obfuscated constant that also decodes to `real`, so the shipped build uses cocoam.co.kr; the alternate `testcocoa.com` endpoint is the test fallback and is not reached at runtime. Samples observed 2014–2017. Provisional bucket pending formal attribution; distinct from the com.map.call SMS-interception family, which the tracker classifies separately as WhiteBroad.