# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 403 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 400619 — https://publicmosaic.com/asn/400619
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 23.153.36.72 3132 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"3a7cad7b96e1d8eda214bfd7b8bc29f847a488ab16e2e53a4d65d6dc57bae68e"; reference:url,publicmosaic.com/indicators; sid:9101706; rev:2;)
alert tcp $HOME_NET any -> 38.14.248.161 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100682; rev:2;)
alert tcp $HOME_NET any -> 38.55.200.183 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104475; rev:2;)
alert tcp $HOME_NET any -> 38.55.200.183 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101338; rev:2;)
alert tcp $HOME_NET any -> 43.224.225.243 80 (msg:"HOLLOWPOINT C2 sqlrce"; reference:url,publicmosaic.com/indicators; sid:9101855; rev:2;)
alert tls $HOME_NET any -> 43.224.225.243 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"68cf40fb3dacb23f769fa7e7c6fa04b7b4eaf030e2cb35d3dacb0aa968c53e45"; reference:url,publicmosaic.com/indicators; sid:9101854; rev:2;)
alert tls $HOME_NET any -> 103.112.99.63 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5fb845ca643ee3650552ed8c4802bcb66401440d728fcfbe2d48746e48d1a35e"; reference:url,publicmosaic.com/indicators; sid:9103919; rev:2;)
alert tls $HOME_NET any -> 116.213.43.162 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1580002a56c13d9d9bed8a67531907536db62316d6d846198e2ae62e7f81aaba"; reference:url,publicmosaic.com/indicators; sid:9105958; rev:2;)
alert tcp $HOME_NET any -> 154.89.195.170 33060 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102730; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106327; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106169; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105530; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106405; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106404; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104648; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104647; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104646; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104645; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105529; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104644; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.104 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104924; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105083; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105889; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105326; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105325; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105324; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104643; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104642; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104641; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104640; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106168; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105140; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105528; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105527; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105082; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105526; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105525; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105524; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104639; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106326; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106167; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105523; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105139; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104638; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104637; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105522; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104636; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104635; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106188; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105888; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104634; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105521; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104633; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104923; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104632; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106599; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104631; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104630; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104629; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106403; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105520; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.99 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104430; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.99 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104429; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105138; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104428; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.101 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104427; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105519; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106166; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.103 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104426; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105517; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105516; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105518; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105137; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.107 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104425; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106323; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106045; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105515; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105514; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.111 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104423; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104628; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104627; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106044; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105513; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106319; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106325; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105511; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105512; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106324; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105322; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104422; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105320; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.121 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104626; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.121 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104420; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.122 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104419; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104625; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.123 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104418; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.124 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104417; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104624; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104623; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104622; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105509; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105510; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105323; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106598; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.99 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104416; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.100 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104415; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104414; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105877; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.101 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104413; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105081; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106595; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105508; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.104 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104412; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.104 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104410; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105321; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105080; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105506; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105507; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105502; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105504; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105136; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105505; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106597; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.110 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104409; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106165; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.111 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104408; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106596; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105503; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106594; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105319; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.114 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103886; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105079; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.115 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104407; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.116 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104406; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.116 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104405; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.117 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104404; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.117 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104403; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106320; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106322; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.119 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105135; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105078; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.120 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104402; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.120 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104401; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.121 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104400; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.121 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104399; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106593; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105317; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.123 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104398; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.123 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104397; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.124 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104396; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.124 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104395; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.125 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104394; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.125 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104393; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.126 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104392; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.98 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104391; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.98 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104390; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105499; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105501; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105316; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105134; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106321; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105887; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106043; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105496; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105498; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106042; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105500; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106316; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.106 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104389; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105479; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104621; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.108 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104388; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104620; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106592; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105495; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104619; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106039; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106310; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106041; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105497; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105492; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106040; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105494; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105318; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105133; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105493; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106400; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.118 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104387; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.119 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104386; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104385; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106401; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106318; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105486; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106164; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106314; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105075; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.124 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104384; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106313; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.126 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104381; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.126 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104383; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106317; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106315; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106130; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106038; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105490; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105491; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106187; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.102 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104382; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105489; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.104 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104380; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.104 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104379; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106589; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106306; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105077; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.106 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104378; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105886; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105488; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106037; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105487; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105485; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105484; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106402; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106591; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105481; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106036; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105483; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106312; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106309; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106590; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106399; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105480; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106035; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105482; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.118 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104377; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.118 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104376; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.119 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104375; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104374; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.120 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104373; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.120 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104372; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.121 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104371; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104618; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105478; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106307; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106311; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106308; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104617; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104370; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104616; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105076; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.98 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104369; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106186; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106131; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104368; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106588; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104367; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104366; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104365; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106185; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104364; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104363; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104362; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104614; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104361; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104360; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105476; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105477; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104615; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104358; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104359; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105474; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106398; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105475; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104613; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104355; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104357; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104356; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106587; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104350; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104354; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104349; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104353; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104345; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104352; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104340; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106034; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104351; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104343; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104348; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104341; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104346; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104347; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104344; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104342; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106395; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106303; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105074; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104339; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106184; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106180; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104338; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104335; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106033; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106028; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.104 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104337; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104336; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104334; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106583; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104612; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106029; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106032; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106030; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106031; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104333; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104332; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106304; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106302; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104331; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104330; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104329; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104328; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106027; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106026; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104327; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104326; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106585; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106025; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106024; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106023; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106183; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106179; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106022; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106297; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106296; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104611; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104325; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104324; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106021; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106586; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105073; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106579; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106305; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106020; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106182; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106396; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106298; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105072; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104323; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104322; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106584; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104321; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105132; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106397; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106181; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106129; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106178; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106019; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105315; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105309; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105473; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105313; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105314; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105311; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104320; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104319; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105308; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105305; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106301; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105312; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106580; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104318; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104317; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104316; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.119 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105307; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105310; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106581; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106300; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.121 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104315; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105071; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106176; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106175; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106578; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106299; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104314; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104313; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105306; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106582; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106177; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.61 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102729; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101524; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102728; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101523; rev:2;)
alert tls $HOME_NET any -> 179.199.198.208 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"683975f5cdf26c2484a4dfd3024b6aec0e0aee7408d7b2900fe407f04faecf82"; reference:url,publicmosaic.com/indicators; sid:9105989; rev:2;)
alert tls $HOME_NET any -> 183.90.187.2 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101170; rev:2;)
alert tls $HOME_NET any -> 183.90.187.73 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101171; rev:2;)
alert tls $HOME_NET any -> 183.90.187.111 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101172; rev:2;)
alert tcp $HOME_NET any -> 186.241.68.124 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102669; rev:2;)
alert tcp $HOME_NET any -> 203.91.75.89 5005 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105017; rev:2;)
alert tls $HOME_NET any -> 203.91.75.89 5006 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9105016; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102637; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 10002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102636; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 20000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102635; rev:2;)
alert tcp $HOME_NET any -> 203.91.77.226 8087 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102634; rev:2;)
alert tcp $HOME_NET any -> 203.91.77.226 8689 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102633; rev:2;)