Data by Hatching Triage

Urelas

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

3

Aug 28

3

Aug 30

1

Aug 31

3

Sep 1

Observed infrastructure

Last seven days

First activity: Aug 28, 2026
Last activity: Sep 1, 2026
Feed role: C2
Host form: 10 IP / 0 hostnames

Leading locations

KR10

Leading providers

SK Broadband Co Ltd5
Korea Telecom3
DLIVE2

Samples

Recent associated samples

0bf61548bc11b09c00759305b5528e587b3595373e6aa9a56bfa8044f7ffbac3

Observed Sep 1, 2026Triage

227c34d2a5d296fac1263e31a979d13a25628649e4a3a5c9475408c4d28bd45c

Observed Sep 1, 2026Triage

81943ca844b190b1f43a2cef84fb93947dd8303df7e43c71b97edeaeeaea0de1

Observed Sep 1, 2026Triage

898ab29f73dd81a562d142fea3dcc5b9954a601df029e156d4f5d515294db0c6

Observed Sep 1, 2026Triage

ae7e78fced532309f0c151108ff7424006c7a5507085446aad03410b602cdfbb

Observed Sep 1, 2026Triage

d6e5aab10a9a05ac2d05badb5dd050ea4a2cf65b73ff69997da9d3cface5cdfd

Observed Sep 1, 2026Triage

da68c084b82a9cf7d641ba284558a7e1d950006625e98e9553c5a04d8592d5b5

Observed Sep 1, 2026Triage

05fd452547f62cc98442cf4c0d649813e5c1f3d774d3d6a2b8f118eebd049b91

Observed Aug 31, 2026Triage

12e19563fd90065482190eeac2304430c104534d4123b0f48d50b07ba87639de

Observed Aug 31, 2026Triage

28c9b1d2e7f9f8f7cc2bb534d814096c88c81f2401b8fe20dc6f676caf645149

Observed Aug 31, 2026Triage

MITRE ATT&CK

Urelas in ATT&CK

7 distinct techniques

Techniques

7 techniques

T1010 Application Window Discovery T1105 Ingress Tool Transfer T1071 Application Layer Protocol T1113 Screen Capture T1547.001 Registry Run Keys / Startup Folder T1001 Data Obfuscation T1560 Archive Collected Data

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage IPinfo urlscan.io Mallory eCrime.ch ransomware.live