- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
8db0f9433eeaf6bc7cfdf36e84d8ef41e243e42e6567b49c2b2f00f1251c3f40- SHA1
f57e9e89be51be318d7add76ab50b4b22d443583- MD5
63cf8dd6653ea1f44f004dd1241d81d1- Filename
- Acorn.app.zip
- File type
- zip
- MIME
- application/zip
- File size
- 10978093
- TLSH
T160B633F98FDC133ACB1372BB2576383350E467991609849E4F74069973F6E3150A2ADB- SSDEEP
196608:IkoZSVOOBcqPKaV2AlJYJsc2jaucLnJRagffIzQ8GFoETfXTHx0zJZgAX48Uj:8ZeLbKYTJYJsc2jaucKgIU8koETfiDXm
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context15 visible
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
objc
1097 bytes
contains
Filename
SPUStandardUserDriver+Private.h
File type
objc
MIME
text/x-chdr
Size
1097
SHA1
b755ef4cf7ebded9082eb2008ba23870f7b5fe5c
0%
objc
13764 bytes
contains
Filename
SUUpdaterDelegate.h
File type
objc
MIME
text/x-chdr
Size
13764
SHA1
545a044adb52582ab1447277b3b632eea9f7471e
0%
c
874 bytes
contains
Filename
SPUUpdateCheck.h
File type
c
MIME
text/x-c
Size
874
SHA1
7cea9f1a8fa36e22725675c97586d382b94d7af5
0%
objc
1105 bytes
contains
Filename
SPUAppcastItemStateResolver.h
File type
objc
MIME
text/x-chdr
Size
1105
SHA1
e3e4036661e628540d61c0a0587eb9270d7eff77
0%
objc
751 bytes
contains
Filename
SPUUserAgent+Private.h
File type
objc
MIME
text/x-chdr
Size
751
SHA1
45365bee0cc8f81ec277d1e594a6d801a337eac9
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
3.41.128.0/17
Network
3.40.0.0-3.43.255.255
First seen
2026-08-23T05:09:48Z
Last seen
2026-11-10T01:58:02Z
US
communicates
CIDR
52.0.0.0/13
Network
52.0.0.0-52.79.255.255
First seen
2026-08-05T15:10:19Z
Last seen
2026-11-10T16:47:45Z
US
communicates
CIDR
17.253.26.0/23
Network
17.0.0.0-17.255.255.255
First seen
2026-06-17T16:09:04Z
Last seen
2026-11-10T18:34:37Z
0%
US
communicates
CIDR
17.253.26.0/23
Network
17.0.0.0-17.255.255.255
First seen
2026-06-17T02:11:36Z
Last seen
2026-11-10T23:46:29Z
0%
US
communicates
CIDR
17.253.26.0/23
Network
17.0.0.0-17.255.255.255
First seen
2026-06-18T22:14:29Z
Last seen
2026-11-10T23:55:50Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
acorncompute.com
TLD
com
First seen
2026-05-01T17:32:54Z
Last seen
2026-10-28T01:30:18Z
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1051.dscg4
First seen
2024-10-11T09:32:55Z
Last seen
2026-11-10T19:31:20Z
0%
.net
communicates
Root
akamai.net
TLD
net
Subdomain
a1864.gi3
First seen
2023-09-30T22:57:34Z
Last seen
2026-11-10T23:03:05Z
0%
.com
communicates
Root
posthog.com
TLD
com
Subdomain
us-assets.i
First seen
2024-02-21T01:17:29Z
Last seen
2026-11-10T16:29:18Z
0%
.net
communicates
Root
akamaiedge.net
TLD
net
Subdomain
e5977.dsce9
First seen
2023-09-28T22:03:10Z
Last seen
2026-11-11T01:21:21Z
Analysis details
mac-appembedded-executablezipsigned
Freshness: Aging · Last seen 41 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
8db0f9433eeaf6bc7cfdf36e84d8ef41e243e42e6567b49c2b2f00f1251c3f40- SHA1
f57e9e89be51be318d7add76ab50b4b22d443583- MD5
63cf8dd6653ea1f44f004dd1241d81d1- Filename
- Acorn.app.zip
- File type
- zip
- MIME
- application/zip
- File size
- 10978093
- TLSH
T160B633F98FDC133ACB1372BB2576383350E467991609849E4F74069973F6E3150A2ADB- SSDEEP
196608:IkoZSVOOBcqPKaV2AlJYJsc2jaucLnJRagffIzQ8GFoETfXTHx0zJZgAX48Uj:8ZeLbKYTJYJsc2jaucKgIU8koETfiDXm- First seen
- 2026-08-26T21:10:14Z
- Last seen
- 2026-09-30T03:27:06Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2023-09-28 to 2026-08-26. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 41 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen 41 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- Acorn.app.zip
- File type
- zip
- MIME
- application/zip
- Size
- 10978093
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCPports 443
- 5+ outbound connections observed
- 0 domains, 5+ IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 5 shown
- IP
- 151.101.3.6
- Port
- 443
- Protocol
- TCP
- IP
- 66.241.125.14
- Port
- 443
- Protocol
- TCP
- IP
- 52.6.170.4
- Port
- 443
- Protocol
- TCP
- IP
- 34.224.193.26
- Port
- 443
- Protocol
- TCP
- IP
- 3.41.202.170
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5
A3 response IPs
- 5 DNS requests observed
- 5 unique queries
- 3 response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- us-assets.i.posthog.com
- Type
- A
- Answers
- 172.66.166.164, 104.20.17.167
- Response
- NOERROR
- Query
- e5977.dsce9.akamaiedge.net
- Query
- acorncompute.com
- Type
- A
- Answers
- 66.241.125.14
- Response
- NOERROR
- Query
- a1864.gi3.akamai.net
- Query
- a1051.dscg4.akamai.net
File certificate
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Certificates3
1 issuer
- Example subject: Argomy LLC
- Issued by: Apple Inc.
- Validity period (UTC): 2026-05-19 – 2027-02-01
View details · 3 shown
- Subject
- Argomy LLC
- Issuer
- Apple Inc.
- Valid from
- 1779163020.0
- Valid to
- 1801519920.0
- Fingerprint
- C87757931710814D7A2081DAEF5612E3EB2928B1
- Subject
- Apple Inc.
- Issuer
- Apple Inc.
- Valid from
- 1328134320.0
- Valid to
- 1801519920.0
- Fingerprint
- 3B166C3B7DC4B751C9FE2AFAB9135641E388E186
- Subject
- Apple Inc.
- Issuer
- Apple Inc.
- Valid from
- 1146001200.0
- Valid to
- 2054670000.0
- Fingerprint
- 611E5B662C593A08FF58D14AE22452D198DF6C60
Behavior details
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- App bundle is code signed
- Classification label
- Connects to IPs without corresponding DNS lookups
- Contains symbols with paths
- Contains symbols with suspicious names likely related to networking
5 shown
View MITRE ATT&CK details · 4 shown
- T1553.002 — App bundle is code signedTactics: TA0112
- T1036 — Contains symbols with suspicious names likely related to virtualizationTactics: TA0005
- T1573 — Imports the Security framework library that provides capabilities to protect information and control access to software (e.g. certificate, key, keychain, or secure transport handling)Tactics: TA0011
- T1071 · T1573 — Uses HTTPSTactics: TA0011