Malware family

Urelas

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

1

Jul 15

2

Jul 16

2

Jul 17

2

Jul 18

Observed infrastructure

Last seven days

First activity: Jul 15, 2026
Last activity: Jul 18, 2026
Feed role: C2
Host form: 7 IP / 0 hostnames

Leading locations

KR6
JP1

Leading providers

SK Broadband Co Ltd4
DLIVE2
SAKURA Internet Inc.1

Infrastructure traits

Hosting 3

Samples

Recent associated samples

00baa709d09ab28ff9a68ae798bc0da54be6f58dbf5dd96ea45c354cf53703b1

Observed Jul 18, 2026Triage

188f247066b81f525718a5eb9d7bfd473ec6299ebdbd4b40f680d6671f7c7548

Observed Jul 18, 2026Triage

2dd286ab240793894e49a40013422499e09240d67e92572353c1cc6e78b2bf9d

Observed Jul 18, 2026Triage

dacb87b9744b42b11ff7dd7a89a06a3a5fcbe6d033f6e3929cbb4b1024691e42

Observed Jul 18, 2026Triage

fb2f7123dfa539aba3b16aac0b3c1b0c38aea8a5f7f76d4c7add28726a2f8894

Observed Jul 18, 2026Triage

1c7180383fece8230d9690aab260e025ad58cf44aa5b6d965c29cb2c67f2d143

Observed Jul 17, 2026Triage

57fb774dccc634681377e9d8f7a10bcf51dc7df19b39b1e7345ed14ea1f292f7

Observed Jul 17, 2026Triage

59f6c4943d42a1182eb07ffee76e43a189901daae4faba2754cd41f32e6d5c98

Observed Jul 17, 2026Triage

afe82b442fe3365a7a647931a4c0515999ee1a2c07d336a808a4886d97fa86d3

Observed Jul 17, 2026Triage

e6a53d9808a504538912d5e58334a28a9aa06cb3879ff8da65adb5090207bb53

Observed Jul 17, 2026Triage

MITRE ATT&CK

Urelas in ATT&CK

7 distinct techniques

Techniques

7 techniques

T1010 Application Window Discovery T1105 Ingress Tool Transfer T1071 Application Layer Protocol T1113 Screen Capture T1547.001 Registry Run Keys / Startup Folder T1001 Data Obfuscation T1560 Archive Collected Data

Reporting

Research mentioning Urelas

Urelas is old, weird, and still watching Korean card games | Derp

Microsoft wrote up Urelas.C in 2012 as a trojan that watched card-game processes and sent screenshots plus host information to a remote server. Fourteen years later, that same shape is still alive. A fresh Urelas sample from April 2026 drops a bit-flipped MSMP state file, watches Korean poker and badugi clients, and packages cropped game-window captures into JPEG/JFIF 6003 records.

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE Tria.ge IPinfo urlscan.io eCrime.ch Mallory