#495·mvt

Suspicious app not installed from the app store or MDM (false detection?)

Author: dkgCreated Apr 30, 2024Updated Aug 17, 2026

A recent run of mvt-ios warned that two applications had not been installed from the app store or from MDM:

Suspicious app not installed from the app store or MDM

in applications_detected.json, both app descriptors contained identical values of the following keys:

{
  "is-auto-download": false,
  "launchProhibited": true,
  "is-purchased-redownload": false,
  "s": 143441,
  "isFactoryInstall": false,
  "gameCenterEverEnabled": false,
  "gameCenterEnabled": false,
  "kind": "software",
  "hasMessagesExtension": true,
  "betaExternalVersionIdentifier": 0,
  "variantID": "iPhone9,3",
  "sideLoadedDeviceBasedVPP": false,
  "DeviceBasedVPP": false,
  "sourceApp": "com.apple.datausage.atc",
  "subgenres": [],
  "rating": {
    "label": "4+",
    "rank": 100
  },
  "icon_sha256": "8f447f708ca1c4cca4d6934c4c1fd0eee374b85ae159befe7534c1a869cc415b"
}

Both also contained a top-level isodate field from the same day (different times) and a com.apple.iTunesStore.downloadInfo member that contains a dict with a purchaseDate (matching the outer isodate but in UTC) and an accountInfo that appears to contain static information about the user's AppleID.

This seems similar to #348, #383, and #487, but i don't know whether it is something to be concerned about. the date is several years in the past, so i don't have great notes about what else was happening at the time. Can you help me make sense of this alert? does the warning need to be tuned to avoid a false alarm?