File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned JAR shows direct-IP contact and two offensive MITRE techniques but zero antivirus detections and a clean community verdict.

Trust score52Caution
MT AI confidence · 62%
Argon.jar
334.7 KB
0ba5c89b4873e2a24ad0bb3390fd
Antivirus engines
0 of 75 flagged
Code signing
Unsigned
Age
First seen 6mo ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

62%Confidence
Moderate
Reasoning

The complete absence of malicious detections across tier-1 and tier-2 engines strongly favors a benign or low-risk classification. However the sandbox observed direct IP contact without DNS resolution and recorded two techniques commonly abused by malware for persistence and defense evasion. Medium prevalence and an explicit researcher comment labeling the sample clean offset the heuristic concern, resulting in a borderline suspicious verdict rather than outright malicious or safe.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines: 0/59 malicious (tier1Malicious=0, onlyLowTrustFlagging=false)

  2. triggeredHeuristics: MalwareTips.Synth.DirectIpC2 fired on IP 162.159.36.2

  3. behaviour.offensiveTechniques: T1543.002 and T1562.001 present

  4. communityComments[0].text: 'Verdict: **Clean** Score: **0/100**'

  5. prevalence.classification: medium (306 submitters)

Points in its favour
  • Zero malicious detections across 59 engines
  • Medium prevalence with 306 submitters
  • Explicit community clean verdict
Points against
  • Direct IP contact without DNS (DirectIpC2 heuristic)
  • Offensive MITRE techniques T1543.002 and T1562.001
  • Unsigned JAR
What to do

Treat as suspicious until additional runtime telemetry or updated AV coverage clarifies intent; do not execute on production systems without isolation.

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
10

Adversary techniques mapped to the MITRE ATT&CK framework.

T1064T1082T1106T1202T1518.001T1543.002T1562.001T1564T1564.001T1564.003
Spawned processes
14
$(unnamed)
"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\<USER>\Desktop\runtime.jar"
$(unnamed)
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
$(unnamed)
C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"" >> C:\cmdlinestart.log 2>&1
$(unnamed)
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
$(unnamed)
"C:\Program Files\Java\jre1.8.0_441\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\sample.jar"
$(unnamed)
/usr/bin/systemctl systemctl --quiet is-enabled cups.service
$(unnamed)
/usr/bin/ls ls /etc/rc[S2345].d/S[0-9][0-9]cups
$(unnamed)
/usr/bin/systemctl systemctl --quiet is-active cups.service
+6 more processes captured.
Network activity
1
IP addresses1
  • 162.159.36.2
Filesystem & mutexes
13
Files written11
  • C:\Users\<USER>\AppData\Local\Temp\hsperfdata_<USER>\6956
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8786.timestamp
  • C:\Users\user\AppData\Local\Temp\hsperfdata_user
  • C:\Users\user\AppData\Local\Temp\hsperfdata_user\1220
+6 more
Files deleted2
  • C:\Users\user\AppData\Local\Temp\hsperfdata_user\6808
  • /tmp/hsperfdata_root/5006
Dropped payload

Files this sample writes at runtime

This file drops 5 children at runtime. None are currently flagged malicious in our cache.

5 unseen
  • 698f7e50cd92e670b7293a5023Never scanned
    never seen before
  • c1de3a9376fdaef0ba6a308b70Never scanned
    never seen before
  • d87c5f3cdfb5b7c0510e1ade9eNever scanned
    never seen before
  • 44a3bab2c338e3bca24cd3b9e7Never scanned
    never seen before
  • ac941ead01d5451a7a9f253227Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2medium

    Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    162.159.36.2
Antivirus engine breakdown

0 detections across 75 engines

0 malicious0 suspicious75 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust20 engines
0flag
Heuristic / generic-AI engines (high FP rate)
All 75 engines report this file as clean.
Hash 0ba5c89b4873… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
306
Hundreds of people have uploaded this — common.
Total submissions
355
Includes repeat uploads by the same source.
First seen by VT
6mo ago
Dec 2, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
12/2/2025, 11:42:46 AM
First seen (MalwareBazaar)
Last analysis (VT)
5/8/2026, 7:19:52 AM
Scanned here
5/17/2026, 7:24:27 PM
File name
Argon.jar
Size
334.7 KB
MIME type
(unknown)
Detected type
JAR
SHA-256
0ba5c89b4873e2a24a31d316a090cc98353ee1d04881695cafee18d0bb3390fd
MD5
8f57ba7e132968ec75473e6f0e7b71b3
SHA-1
39b697a348d8f711eb9aeb9b7d914faf8642a6ed
First seen (VT)
12/2/2025, 11:42:46 AM
Last analysis (VT)
5/8/2026, 7:19:52 AM
First scan (MalwareTips)
5/17/2026, 7:24:27 PM
Last scan (MalwareTips)
5/17/2026, 7:24:27 PM
Behavior tags
detect-debug-environmentjarchecks-cpu-namesets-process-name
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.