Malware

Urelas

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HKCU Software\Microsoft\Windows NT\CurrentVersion\Windows value Run first-child persistence path

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HKCU Software\Microsoft\Windows NT\CurrentVersion\Windows value Run first-child persistence path

Discovery

1 technique

T1010Application Window DiscoveryEvidence1

The target process list in this sample includes Korean poker, badugi, high-low, and launcher surfaces: highlow2.exe, poker7.exe / Poker.exe, Baduki.exe / Newbadugi.exe, HOOLA3.exe, DuelPoker.exe, PMLauncher.exe / _PMLauncher.exe.

Collection

2 techniques

T1113Screen CaptureEvidence1

Microsoft wrote up Urelas.C in 2012 as a trojan that watched card-game processes and sent screenshots plus host information to a remote server... A fresh Urelas sample from April 2026 drops a bit-flipped MSMP state file, watches Korean poker and badugi clients, and packages cropped game-window captures into JPEG/JFIF 6003 records.

T1560Archive Collected DataEvidence1

A fresh Urelas sample from April 2026... packages cropped game-window captures into JPEG/JFIF 6003 records.

Command and Control

3 techniques

T1001Data ObfuscationEvidence1

golfinfo.ini is not a normal INI file. It is a 512-byte state/config file where every stored byte has been bit-flipped... The parser flips every bit in those bytes and expects to see MSMP.

T1071Application Layer ProtocolEvidence1

Its command-and-control path runs through Korean ISP space... The active DLIVE/SK Broadband path for this sample has three endpoints: 121.88.5.183:11120, 121.88.5.184:11170, 218.54.30.235:11120... On the wire, each message starts with its length: 4-byte big-endian length, record body.

T1105Ingress Tool TransferEvidence1

The second child also carries a helper resource... The child writes and loads this helper as HGDraw.dll when the selected game/process path needs it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

derp ca blogNews

Apr 25, 2026

Urelas is old, weird, and still watching Korean card games | Derp

A specialized surveillance trojan focused on Korean card-game clients. It monitors specific game processes, captures and crops game-window screenshots, compresses them into JPEG/JFIF records, and sends them along with host/state information to command-and-control servers. It also uses a helper DLL for capture operations and maintains persistence via a Run registry value.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Urelas

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HKCU Software\Microsoft\Windows NT\CurrentVersion\Windows value Run first-child persistence path

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HKCU Software\Microsoft\Windows NT\CurrentVersion\Windows value Run first-child persistence path

Discovery

1 technique

T1010Application Window DiscoveryEvidence1

Collection

2 techniques

T1113Screen CaptureEvidence1

T1560Archive Collected DataEvidence1

A fresh Urelas sample from April 2026... packages cropped game-window captures into JPEG/JFIF 6003 records.

Command and Control

3 techniques

T1001Data ObfuscationEvidence1

golfinfo.ini is not a normal INI file. It is a 512-byte state/config file where every stored byte has been bit-flipped... The parser flips every bit in those bytes and expects to see MSMP.

T1071Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

The second child also carries a helper resource... The child writes and loads this helper as HGDraw.dll when the selected game/process path needs it.

INDICATORS OF COMPROMISE

IOCs tracked for this family

11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

derp ca blogNews

Apr 25, 2026

Urelas is old, weird, and still watching Korean card games | Derp

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching11

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.