tispy | 7303761333f194d788b03943404c409e4a6c167e5c633055ba9bdefb6c3f730b

Analysis

max time kernel
26s
max time network
150s
platform
android-9_x86
resource
android-x86-arm-20260325-en
resource tags

arch:armarch:x86image:android-x86-arm-20260325-enlocale:en-usos:android-9-x86system
submitted
06/10/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_base.apk
Size 2.9MB
Sample261006-jsnp3adh43
SHA256 7303761333f194d788b03943404c409e4a6c167e5c633055ba9bdefb6c3f730b
MD5 58d8fdd7e2e102b2c7b5429b2075de61
SHA1 87f34c4477c290f9742e14f02e75a034afd07c5c
SHA512 1870f00da32d2b7f4db69af6d5b2e682ae9bbcd0fc6cb4d0c29a57a3ae40910842ab1da422b2b6407131f65cdc51c595bac0f25ceb4b54ceef7d571389dce0aa
SSDEEP 49152:fRtk4PA1LWb5aCcMtmxVXqLjlEMVx47gqEqmC2ViKWoqiA6K6SJrj4L:fRt3PA1L4a3MtWV6Ljase79FmCgiKhqO
TLSH
T1F6E51233FA66994AC5B5CF7116346636100E8C34834F635B785DBBBE27BF9E80E84684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery evasion tispy infostealer persistence spyware trojan

Malware Config

Extracted

Family

tispy

https://kidsshield.net/events/printIPN.jsp?screen=IntroScreen&deviceid=358240051014041

Signatures

Family: TiSpy
TiSpy is an Android stalkerware.
trojan infostealer spyware tispy

Loads dropped Dex/Jar 1 TTPs 6 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip	4406	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/oat/x86/2357a75cc84bcdf0.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip	4378	com.oxesirqx.dzidsfzx
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip	4429	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip --output-vdex-fd=4 --oat-fd=44 --oat-location=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/oat/x86/zPZkpFoAaDurCUSqg.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip	4378	com.oxesirqx.dzidsfzx
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip	4378	com.oxesirqx.dzidsfzx
/data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip	4378	com.oxesirqx.dzidsfzx

Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getScanResults	com.oxesirqx.dzidsfzx

Queries the phone number (MSISDN for GSM devices) 1 TTPs
discovery

System Network Configuration Discovery
T1422

Requests cell location 2 TTPs 1 IoCs

Uses Android APIs to to get current cell location.

collection discovery defense_evasion

Location Tracking

T1430

Geofencing

T1627.001

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getCellLocation	com.oxesirqx.dzidsfzx

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.oxesirqx.dzidsfzx

Domain associated with commercial stalkerware software, includes indicators from echap.eu.org 2 IoCs

flow	ioc
9	kidsshield.net
8	kidsshield.net

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.oxesirqx.dzidsfzx

Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.wifi.IWifiManager.getConnectionInfo	com.oxesirqx.dzidsfzx

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.oxesirqx.dzidsfzx

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.oxesirqx.dzidsfzx

com.oxesirqx.dzidsfzx
1⤵
- Loads dropped Dex/Jar
- Queries information about the current nearby Wi-Fi networks
- Requests cell location
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
PID:4378
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/oat/x86/2357a75cc84bcdf0.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4406
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip --output-vdex-fd=4 --oat-fd=44 --oat-location=/data/user/0/com.oxesirqx.dzidsfzx/files/dex/oat/x86/zPZkpFoAaDurCUSqg.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4429

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Execution Guardrails

T1627

Geofencing

T1627.001

Credential Access

Discovery

Location Tracking

T1430

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Location Tracking

T1430

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

privatesms.db

Path /data/data/com.oxesirqx.dzidsfzx/databases/privatesms.db
Size 16KB
SHA256 8620d146b06037c9dc98b8788c3137344eb9d7e1f8b982ffec4c1d8549f24dd5
MD5 3621ce0aa81e37bc5c80e2cf881f1dd0
SHA1 00365f82dcada94caea07443656848baf60b3bd9
SHA512 76bb7175359d61ce39e95008269752de25769c4e274b4bcf37b920bc2cbfb680b2a4a88de860ed069655d1f47604638b0301c2c6131107cd929348895d73d2bf
SSDEEP 6:l9FClq1pO64yXsfzhd6mQLuCeC9F8KCPzRtSzxERX4PBX4ogLugMBX4suuK0Dqif:TgqfO6PstjVC7nCjRmBEyPbBvOw
TLSH
T16872D8AD87083213C1640372A4C4D3203C78651F57636342785110B5FC86659B463EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

privatesms.db-journal

Path /data/data/com.oxesirqx.dzidsfzx/databases/privatesms.db-journal
Size 512B
SHA256 01510569e5a40f50f7425fb4d3c25912a2d29399a9f973e5e67bcdd14ebe1d5c
MD5 b0993807b12a932879aea38810c25b0f
SHA1 01ec1e7d3bf148a49d4493445d0e7916b9f415f3
SHA512 b00bdfe0d5823d11c240540e55b448aa1864aeceb64537187788312677329538f09e6bc50d06789bcf72fd3c75ff9b0d83285a9cfaf8c7595ad8324a1ddd57d1
MD5 SHA1 SHA512

Submit Download

privatesms.db-shm

Path /data/data/com.oxesirqx.dzidsfzx/databases/privatesms.db-shm
Size 32KB
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

privatesms.db-wal

Path /data/data/com.oxesirqx.dzidsfzx/databases/privatesms.db-wal
Size 28KB
SHA256 8e95e67961c35c840196ae11368c673f70beb2dcad035b1511a55f4ce1c51bc3
MD5 191bbae36369934a3becebee52ab066b
SHA1 5986356062942563b572f00d93520f712174d30c
SHA512 c1b1d81976032e6a9918da47b5d8a9f35c9a76fcc17d2d72daa1c84cf573f3116ac6fe178aff98d8eade094c36af9833a594c45704073fc04a352740c6581657
SSDEEP 12:KL/jzdTRmBEyPbP/8K4OwClZlgqfO6PstjVC7nCjRmBEyPbP/bZsLuH:KLLzyGSP/8PA16YJGSP/bZfH
TLSH
T17AD29EA99B462313C018137260CDC3902E6CE21F536BDB5379511465BC8F7DCF0A2E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

464066.so

Path /data/data/com.oxesirqx.dzidsfzx/files/464066.so
Size 145KB
SHA256 26e9d98c2797fe9ee048a3a0afbb7e12e1c9d0eb165995d9aaacbea374b6f666
MD5 fe2c4c04da3457c94f084ab9599e5676
SHA1 a3d238c4a7c472ae347a85caca451438484bca00
SHA512 5978a953b402276488c8a3c09dc131b48bb27702b438055c4949a60be9bbce7b603bf1de21cd309fe8528f2a253144a118f8dbf00eac9cb6f1ee35b0aaf5a49d
SSDEEP 3072:2LBuzFYnl6Tqs9Wn9OLgT4toCDEhL0Ci/7NOK0D8u2Gn6Uu5cQ3lMVCe5gt5SBsz:2LAzFYnl6Tqs9Wn9OLgT4toCDEhL0CiR
TLSH
T125E37C5AF41F4C2AC49A5B3926C707C27E208AEAE35003741E9D87757A7B5F4DE4E2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2357a75cc84bcdf0.zip

Path /data/data/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip
Size 773KB
SHA256 b9f2343a18fb212f2f10177450c9e571e3f4d1edf4809b4b2eb3105cd8672acf
MD5 4454ae04504988c1f4bc42b306ea7b62
SHA1 126c570be219f096da6ce09695fd8911d68329b1
SHA512 0c5f8c709b5106618ab0c087256289f711a2f06494e2134b709517bd8ce24ece3fab8ae32f57cd339b0f11c2c5a333ee9d565baa9b71fe99e4559820db89ccf8
SSDEEP 12288:+qt1jjWLxZczo39wkjaQLdJzRSPVy1f59Py2U0TrWck061KO0XXG:5mNSQ3joVy1x9PvrW8qKNXXG
TLSH
T14BF433FB65079FF6BA31CFB25AC4D9861909F6FEA030685802E5B1FB5489142F7D8D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zPZkpFoAaDurCUSqg.zip

Path /data/data/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip
Size 646KB
SHA256 e1a8cc397275904df728b4248177312693dbb64d6a3c8dcfc3e4c1a66e9ea7a1
MD5 49bf695483d3cc90d99e248314d15bfc
SHA1 8e01ee247899d6059ebe0f347d5bace92d9c6427
SHA512 ee54ebdb646963205e786ac42136e221334005d0f560342c39f0ec43f5397f38d2edcccd1e9264fe952347b310a9e2faedcd0e25427972ceceb25ffe3b56ccda
SSDEEP 12288:QRSehq5L8d5tiCKXGDdztFMz18dUp+WRxaw08BO9xv0h3lMr+pmKQk/H6AX:QRRqedOCKXQ2uijxaw08MEh3Sr+R5H6E
TLSH
T19EE4334FC0F3580358C5BAF84587E1CBD7DD09669D42D80D8BBEFA0429CAB4D9816A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sistema1791273369721.log

Path /data/data/com.oxesirqx.dzidsfzx/logs/Sistema1791273369721.log
Size 8KB
SHA256 3c10bef1c90460fbba0bbb90f38e2c7f14a185b8bf59b324f00771755d0df4d6
MD5 ab521bc05afad5bb142a8ce911ca94f4
SHA1 55f7a4f66d4f9c01a508911444c96d2f2fc133e4
SHA512 839aeed3662234bb67119e3b893c1e371d45332748e98488a4f0bfc3a5be54b4844cbb34e9607ae73a462fc11b0dcd11e5dd55004405cfa1ed4d76268e776b15
SSDEEP 192:Bikc1yvCJ5WhkWWbRgIlmDHq85KcLyMTgRHvyIJ:Bikc1yv25WhkWWbRgIlmDHqsKcL/6qIJ
TLSH
T1E702666B8D110F121F89C563141DC6095715BF6683393631ABC1CAE2BEE764F82E8BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2357a75cc84bcdf0.zip

Path /data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip
Size 1.8MB
SHA256 90f696dae958d18fcc43de02cc2fef56d97e44fd187d11a657cfee50acfbd5ce
MD5 e3e54158889e6f744ce16b9a70e8bb49
SHA1 de1a09449b991bf4ef0c9f93cb47e194cbdb83e3
SHA512 a31bb2cc98f8722236f96d55f18d4c482c7ece5cccfdb83a53e28e5fbb583a9fe2b89a20592435510fa12597e64dfd62e677314a17da97c271191d6b4ffb3d15
SSDEEP 24576:kd32vcRDTYyn5zJ5gestl6UM1Yj3NyP4kf5KeWree4FWG9cqGd/4rhIxxfAjtXL:6TPw9ree4FWG9cqQxAjF
TLSH
T1DC952A0361924E27F57D8BB3866757D4737261522F43EB2B219421BEECB32C16BC829D
MD5 SHA1 SHA512 SSDEEP TLSH

Download

2357a75cc84bcdf0.zip

Path /data/user/0/com.oxesirqx.dzidsfzx/files/dex/2357a75cc84bcdf0.zip
Size 1.8MB
SHA256 f71df8d82c43fcd90c6942b099e708237eae99451575bf0731b88fa4bc50e6c8
MD5 70d88c3e73945ac70d94af57fb39e48a
SHA1 31028072469410db9c6580de3c86cf8d47cfcfbc
SHA512 a1bbbcc6e650d5dd62defc806de0251e0ac69aca57fabbf89e896d30f1234de565897791aa988b6a426c50297e5635354d5fc3b63d0cee6f21025ad88a2faf25
SSDEEP 24576:kd32vcRDTLNmDutb0DA5KeKoHve4FWG9cqGd/4rhIxxfAjtXL:6TxmUIave4FWG9cqQxAjF
TLSH
T14E957D0372D28D65E5BC87774A6527503771B1226A43EB3B21B064AFEDB32C17AC4D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Download

zPZkpFoAaDurCUSqg.zip

Path /data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip
Size 1.6MB
SHA256 7a676175aaad942ea34010a79d4d28df4b0796b8535ebe94b9bd4440ea93f6e9
MD5 7df76d4ad618927ed5f847feaef3f401
SHA1 b39f915941c63fe2682135759f8bfcdf7c6a4af1
SHA512 bf14704f0709c36e9105f8a6cfa3877ed731d18e97238dcafcc8e97d77028d4232618a392121b62391c4784eca39bde05009378da97be2889f073165082573c5
SSDEEP 24576:BA1PzoZPJkXAXQXUXFruDLquz8Q+wbxP3addbwmBjVU:C+mK62FiRrvadK0hU
TLSH
T1FE855A02B3110E33C46C4B3754BB5BA57B32728A6F438B0B2558977CBC976C96BD5B88
MD5 SHA1 SHA512 SSDEEP TLSH

Download

zPZkpFoAaDurCUSqg.zip

Path /data/user/0/com.oxesirqx.dzidsfzx/files/dex/zPZkpFoAaDurCUSqg.zip
Size 1.6MB
SHA256 894bae82f4f7412710752f5e7249474487a8b80c1d75c0aa6c0e9d45520d3e0a
MD5 c32817026bde58a2f633f52f44aba1c4
SHA1 f93a57f24697d87d35d8ecf8c1dfa984ece8e13a
SHA512 2f01225bd65d1860daff275ac50f7f51a3bb9e8f2aca58bfbf2f2eaf28630cd3547a66b5f968f68c7764e0e3b1bb0a14e733183a8cdbb1071b96206cf1004c76
SSDEEP 24576:BA1PzoZPJkXAXQXUXFruDLXHSNRYWAtfq0EatmbwmBjVU:C+mK62FiCRaX0hU
TLSH
T105854803B7014D32C8AC863A24BB5B653B35768AAF434B172159CBBC7C876C5ABC5BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads