URLhaus Database

URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as Kharon.

Database Entry

Payload

The table below shows all payloads that have been identified as Kharon.

Firstseen (UTC)	SHA256	File Type	File size
2026-10-27 11:57:06	2cfd091418adf115ffda13a3c0bdee1051b6713b784d2773cbaa5ed1a84851d5	exe	215'552
2026-10-27 11:57:06	3147f07bd6405ecafa1c40012524ab48aa62234e9556b2f9a88a83624e10c385		2'027

Number of entries displayed: 2 (max: 1'000)