Cereal2 · Observed attack

AS262594 UDP flood on 177.84.244.0/23 | 2026-10-12 23:51:07Z

· Event #327794

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-12T23:51:07.321Z
Recorded

Recorded 263ms after observation

Affected network
177.84.244.0/23
Network operator
4iNET CommunicationsAS262594
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
119.45.12.154139.59.33.238157.230.127.22164.90.186.13165.22.152.158170.106.35.197178.128.223.92188.166.12.8206.189.228.1743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.173.37.5364.227.72.6877.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15994.183.235.24995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
000000009f ca b6 a0 80 3c 62 17.....<b.
0000000899 d5 5d 87 5e 8b 3c e0..].^.<.
00000010db 6f 0f 81 01 27 cc 9f.o...'..
000000188f 83 ae 7c 67 27 4c e3...|g'L.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

b0328fd6668e346ba7b59f97ed46f0f7ab54c169d50a1194bab8438006da995e

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
9fcab6a0803c621799d55d875e8b3ce0db6f0f810127cc9f8f83ae7c67274ce3

Original bytes (Base64)

OWZjYWI2YTA4MDNjNjIxNzk5ZDU1ZDg3NWU4YjNjZTBkYjZmMGY4MTAxMjdjYzlmOGY4M2FlN2M2NzI3NGNlMw==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.