# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 8 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 58232 — https://publicmosaic.com/asn/58232
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 217.60.195.25 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8af21871985903fa963836f77991476ed447eb070702e66a8eaac9f697f00977"; reference:url,publicmosaic.com/indicators; sid:9100876; rev:2;)
alert tls $HOME_NET any -> 217.60.195.89 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7f176319f7a4637f8d22e3478559eb4e81f28a1c3e5245d95bfa58314d23f2c7"; reference:url,publicmosaic.com/indicators; sid:9101150; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"aae970e704d6970354b12c3f834b00f8d56d4857afa66886161d8017b95ea58b"; reference:url,publicmosaic.com/indicators; sid:9101470; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101469; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101468; rev:2;)
alert tls $HOME_NET any -> 217.60.195.139 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"47adc6a64c0a1250e177abcbff7b2004a0d83b1a787974086c15711d233b358f"; reference:url,publicmosaic.com/indicators; sid:9101238; rev:2;)
alert tls $HOME_NET any -> 217.60.195.193 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f4be79a934eececfb72d0d2252478b2d1272d77343ea065c55bf902c3d4482ba"; reference:url,publicmosaic.com/indicators; sid:9104161; rev:2;)
alert tls $HOME_NET any -> 217.60.195.226 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04ed4773b612b28ee230eae5e973803354488ea22a7fa31f15408694c80d14b6"; reference:url,publicmosaic.com/indicators; sid:9104160; rev:2;)