Urelas is old, weird, and still watching Korean card games

Urelas is boomer malware with a very specific hobby: Korean card games.

Microsoft wrote up Urelas.C in 2012 (opens in new tab) as a trojan that watched card-game processes and sent screenshots plus host information to a remote server. The process list in that old writeup included baduki.exe, DuelPoker.exe, highlow2.exe, HOOLA3.EXE, and poker7.exe.

Fourteen years later, that same shape is still alive. A fresh Urelas sample from April 2026 drops a bit-flipped MSMP state file, watches Korean poker and badugi clients, and packages cropped game-window captures into JPEG/JFIF 6003 records. Its command-and-control path runs through Korean ISP space, including SK Broadband and DLIVE hosts.

This is not one dusty binary that happened to run. Across the current Urelas observations, the family appears in 3,166 sample rows and 3,142 unique SHA256s from March 13 to April 22, 2026. April alone accounts for 2,311 unique SHA256s through April 22.

That makes the old Urelas idea worth revisiting. It is not trying to be a modern stealer with a thousand features. It is closer to a game-table surveillance tool. Find the card-game client, capture the useful part of the window, compress it, and send it out.

If you operate a threat intelligence platform with API access and can provide a researcher account, please reach out to kirk@derp.ca. Additional data sources directly increase the quality and coverage of the threat intel published here.

---

Sample overview

The original sample was collected from Triage submission 260419-mkg44agt3r. Controlled execution showed the parent writing an intermediate executable, writing golfinfo.ini, launching the intermediate, and building socket targets for three command-and-control endpoints.

Family footprint

The March-April activity is much larger than the first short view suggested.

The infrastructure is concentrated by ASN:

The sample below shows one branch of that activity: config, endpoint selection, game-window capture, and helper DLL behavior.

Why card games

Urelas makes more sense when you stop reading it as a generic remote-access trojan.

The target process list in this sample includes Korean poker, badugi, high-low, and launcher surfaces:

Those names are not random. They overlap heavily with the 2012 Microsoft process list and with the games still marketed by Korean card-game platforms. Hangame Poker's Google Play listing (opens in new tab) advertises Seven Poker, Low Badugi, Hold'em, and High Low. Pmang Poker for Kakao (opens in new tab) advertises 7 Poker, high-low, and low badugi, and the listing shows more than one million downloads.

These games are not valuable to Urelas because they are games in the Steam-library sense. They are valuable because the screen is the state. A capture can show the client, table view, game type, room context, cards, betting state, and account-side clues. That is why this malware keeps coming back to screenshots rather than browser cookies.

It is old, but the idea is not dumb. It is narrow.

Execution chain

This sample runs through three executables:

original sample
  -> intermediate child
  -> golfinfo.ini
  -> UPX-packed second child
  -> decoded MSMP state
  -> Korean command-and-control endpoint loop
  -> game-window capture path
  -> JPEG/JFIF 6003 records

The first intermediate is unusual. The emitted file matches the original sample exactly, then adds a changing 50-byte tail. A second controlled run used different random names and produced a different 50-byte tail, but the chain stayed the same.

The next executable is cleaner. The dropped child is packed with stock UPX. Unpacking it gives a stable Windows executable:

d5149aea7c8264fb2f13435d8243331b1ce08f0bf53e12bb11bac01d11554ac7

That unpacked child contains the game-client strings, MSMP parser, socket helpers, record builder, capture path, and embedded helper DLL resource.

MSMP state

golfinfo.ini is not a normal INI file. It is a 512-byte state/config file where every stored byte has been bit-flipped.

The first four bytes are the obfuscated config marker:

b2 ac b2 af

The parser flips every bit in those bytes and expects to see MSMP:

4d 53 4d 50
MSMP

The parser at fcn.00405910 reads 512 bytes, flips every bit, and accepts the result only when the decoded 32-bit value is 0x504d534d / MSMP.

The decoded config contains:

The MSMP state matters because both child executables read it. The first child uses the decoded hosts 121.88.5.183 and 218.54.30.235, then copies the 11120 port into its socket path. The second child also copies decoded host, port, and state fields before it starts its own network loop.

The .184 endpoint is not in the config

The active DLIVE/SK Broadband path for this sample has three endpoints:

The middle endpoint is the easy one to get wrong. 121.88.5.184 and 11170 are not in the decoded golfinfo.ini config.

The first child contains embedded 121.88.5.184 strings. Its endpoint loop chooses that host from code and selects the port through an OS-version check. Instrumented execution confirms the socket arguments:

That distinction matters for detection and analysis. If you only decode golfinfo.ini, you miss one endpoint used during execution. If you only trust dynamic traffic, you miss why that endpoint appears.

Protocol records

The second child has its own protocol handler. The recovered code prepares several record types:

On the wire, each message starts with its length:

4-byte big-endian length
record body

The receive format and local/control parser are visible in the unpacked code.

Screenshots are the payload

The 6003 path is the clearest explanation of what this malware is for.

The unpacked child uses Windows screen and window capture APIs, including GetWindowDC, CreateCompatibleBitmap, PrintWindow, BitBlt, and GetDIBits. It then crops game-specific regions before encoding the result.

The encoder at fcn.0040b380:

• validates bitmap-like input
• limits the quality/control argument to 10..100
• converts 32-bits-per-pixel rows to 24-bits-per-pixel
• writes to a memory buffer
• uses embedded JPEG/JFIF code paths
• returns the output length used by the prepared 6003 record

That ties the old Microsoft behavior to this sample. Urelas is still watching card-game windows and sending screenshots. The capture path is visible in the unpacked code and tied to the protocol record that sends the image.

HGDraw.dll helper

The second child also carries a helper resource. Resource 130, type UNKNOWN (1144), language LANG_KOREAN, is a ZIP container. It contains:

CaptureDll_pe.dll

The child writes and loads this helper as HGDraw.dll when the selected game/process path needs it.

Local helper execution reaches the helper code, resolves capture APIs, and enters the expected Sleep(0xc8) wait loop. The exports used by the parent are simple:

The parent-facing behavior is clear: this DLL is a command-gated capture helper, and the second child can pull its output into the 6003 path.

Detection shape

The hunt is the combination, not one perfect indicator.

For this sample, the compact endpoint set is:

The broader family footprint includes more infrastructure than those three IPs. The endpoint set above is the compact set for this sample.

Urelas is not dead, and it is not generic. In 2026, this old family is still doing the same narrow job it was doing in 2012: watching Korean card-game clients and sending the table view home.