# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 18 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 149440 — https://publicmosaic.com/asn/149440
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.27.24.103 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"23e245201ce240f543c5a51eac686178ffba1baf74c05297e9a12f09d45ade34"; reference:url,publicmosaic.com/indicators; sid:9101751; rev:2;)
alert tcp $HOME_NET any -> 23.27.47.158 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100996; rev:2;)
alert tcp $HOME_NET any -> 23.27.51.31 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103228; rev:2;)
alert tls $HOME_NET any -> 23.27.52.106 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"da5d45c548948013f3ba44d449df1cf7d74686f0cfc8cbc8bf3f79bb946ffca0"; reference:url,publicmosaic.com/indicators; sid:9100683; rev:2;)
alert tls $HOME_NET any -> 23.27.52.106 28736 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"da5d45c548948013f3ba44d449df1cf7d74686f0cfc8cbc8bf3f79bb946ffca0"; reference:url,publicmosaic.com/indicators; sid:9104246; rev:2;)
alert tcp $HOME_NET any -> 23.27.245.118 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106441; rev:2;)
alert tcp $HOME_NET any -> 96.126.191.30 6080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101004; rev:2;)
alert tls $HOME_NET any -> 108.165.147.100 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"b8882e2040379c3802b3bed7f512dce8f83bc5c018dcbd3757a04292dd488acc"; reference:url,publicmosaic.com/indicators; sid:9101813; rev:2;)
alert tls $HOME_NET any -> 108.165.255.26 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"691e25dab78c241a8b72bb3abdf9d20f18e249ea5b556dab82d40032bcda2389"; reference:url,publicmosaic.com/indicators; sid:9101812; rev:2;)
alert tls $HOME_NET any -> 166.0.106.156 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"67f93e9b2a3cec0bd8d01f983247fddfca5328d08f837d48810524f6944c793e"; reference:url,publicmosaic.com/indicators; sid:9106616; rev:2;)
alert tcp $HOME_NET any -> 166.88.90.53 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103486; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9100877; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9101175; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9101176; rev:2;)
alert tls $HOME_NET any -> 166.88.95.90 5000 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e72a4ede8400ffc530affc4b18fea4c0a17857a0bab2852c64ecb6f5884919d8"; reference:url,publicmosaic.com/indicators; sid:9101331; rev:2;)
alert tcp $HOME_NET any -> 166.88.97.92 808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105872; rev:2;)
alert tcp $HOME_NET any -> 166.88.209.196 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103485; rev:2;)
alert tcp $HOME_NET any -> 166.88.209.196 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103484; rev:2;)