# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 33 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 202412 — https://publicmosaic.com/asn/202412
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 91.92.240.102 3000 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"22c12e45f24935d9fed14b3c5bd2926d799fdaaff64c73cd019e8e6443c40c51"; reference:url,publicmosaic.com/indicators; sid:9101196; rev:2;)
alert tls $HOME_NET any -> 91.92.240.238 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100764; rev:2;)
alert tls $HOME_NET any -> 91.92.240.238 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"22c8467c27a4622f6665fbb430a466d585b13f3dd693fc5dbbc6d49d5ec816f7"; reference:url,publicmosaic.com/indicators; sid:9100734; rev:2;)
alert tls $HOME_NET any -> 91.92.241.38 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"96ab27fd0397c6ce461c71947490e9c3c5c2bacb0f58afd5af50b9fdf23e24b7"; reference:url,publicmosaic.com/indicators; sid:9100423; rev:2;)
alert tls $HOME_NET any -> 91.92.241.184 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b0a202cb6efdd0d25d7081bf6adc697d80c0d0c91f29b1db0ebd87837812bc1a"; reference:url,publicmosaic.com/indicators; sid:9105791; rev:2;)
alert tls $HOME_NET any -> 91.92.241.187 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b0a202cb6efdd0d25d7081bf6adc697d80c0d0c91f29b1db0ebd87837812bc1a"; reference:url,publicmosaic.com/indicators; sid:9105790; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 2087 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102905; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102904; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102903; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7171 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102902; rev:2;)
alert tls $HOME_NET any -> 91.92.243.36 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"4a172c28e3ea3f86d93aec642d017b528414ca3f6ca2959ed03238b1a43c5d97"; reference:url,publicmosaic.com/indicators; sid:9101436; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106454; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106453; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106452; rev:2;)
alert tls $HOME_NET any -> 91.92.243.115 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"460bcde32bc67082373c9ad32d09e9c67337590d66b8b72301fa58fd0f6d94d1"; reference:url,publicmosaic.com/indicators; sid:9100661; rev:2;)
alert tls $HOME_NET any -> 130.12.180.237 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9101733; rev:2;)
alert tls $HOME_NET any -> 146.19.125.151 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"760ff351b2ad8929fee82d3f7dde81d886919311de173984bed30bc1d2f9d377"; reference:url,publicmosaic.com/indicators; sid:9102052; rev:2;)
alert tls $HOME_NET any -> 158.94.208.19 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"72be13aa8661f548968113cec883ba2e1423bab3c9cd801682f090b3ed28c281"; reference:url,publicmosaic.com/indicators; sid:9104445; rev:2;)
alert tls $HOME_NET any -> 158.94.208.154 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f0702a4c53a1e1afc15b177a917a692056adc9ec6d3293bf4e9811d0f6f60782"; reference:url,publicmosaic.com/indicators; sid:9101967; rev:2;)
alert tcp $HOME_NET any -> 158.94.209.159 9981 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105881; rev:2;)
alert tcp $HOME_NET any -> 158.94.209.209 3009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105863; rev:2;)
alert tls $HOME_NET any -> 158.94.210.131 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"42c6ba12623518c31b561c881a13a458bcabfcdc67ad638f0bc940f54bd8d884"; reference:url,publicmosaic.com/indicators; sid:9104127; rev:2;)
alert tls $HOME_NET any -> 158.94.210.131 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1e78cc9e4f2ef06f8411549857b5474e708e15a49c76bae019fab362661c6210"; reference:url,publicmosaic.com/indicators; sid:9105820; rev:2;)
alert tls $HOME_NET any -> 158.94.211.158 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"39ba16f179f41d46df324d28c145fab29abb288bf3fb09270baf3ce724ab9686"; reference:url,publicmosaic.com/indicators; sid:9105813; rev:2;)
alert tls $HOME_NET any -> 178.16.52.22 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"68932e254d6e12e74c19a2afd861566b989afc207afab4c1429aa16b9572f92c"; reference:url,publicmosaic.com/indicators; sid:9100600; rev:2;)
alert tcp $HOME_NET any -> 178.16.52.120 8767 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102692; rev:2;)
alert tcp $HOME_NET any -> 178.16.52.120 8787 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101173; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102691; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102690; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102689; rev:2;)
alert tcp $HOME_NET any -> 178.16.54.201 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104126; rev:2;)
alert tls $HOME_NET any -> 178.16.54.229 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c0107e207bd8a3aeca4de50946c74e6abeb6a8568e8a5badbf5eab36559ba18c"; reference:url,publicmosaic.com/indicators; sid:9100093; rev:2;)
alert tls $HOME_NET any -> 178.16.55.133 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a68234874e32dda82ae90383b731cb4c0e6d53737059876b1f979cea13d02a73"; reference:url,publicmosaic.com/indicators; sid:9101286; rev:2;)