# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 9 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 6134 — https://publicmosaic.com/asn/6134
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.147.164.81 13389 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103171; rev:2;)
alert tls $HOME_NET any -> 38.147.164.81 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"30161e690dc095979bdcf3f60c88b3dd04b01b089c66764b66493a5657e6154d"; reference:url,publicmosaic.com/indicators; sid:9100403; rev:2;)
alert tcp $HOME_NET any -> 45.135.118.214 2086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103081; rev:2;)
alert tcp $HOME_NET any -> 45.135.118.214 8880 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103080; rev:2;)
alert tls $HOME_NET any -> 182.255.44.231 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"324e3cd776ec2f2286929f663288a2b18000ef5e3822bc59738a6459366e9ae4"; reference:url,publicmosaic.com/indicators; sid:9100092; rev:2;)
alert tls $HOME_NET any -> 182.255.45.50 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4bd148c5c8b0e49686503b355e1083bc23d3184f70135ce9424c0c7fef10c6fb"; reference:url,publicmosaic.com/indicators; sid:9100703; rev:2;)
alert tls $HOME_NET any -> 182.255.45.50 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"86a11eda8a8b64d49871919f028f3c416a8c092e00cdee0610fbdcf3106483fd"; reference:url,publicmosaic.com/indicators; sid:9100297; rev:2;)
alert tls $HOME_NET any -> 182.255.45.114 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"329fda88e01ab35b161a16123e703c8e53afff9e39c5efdc5f76d8cde3fc944f"; reference:url,publicmosaic.com/indicators; sid:9100638; rev:2;)
alert tls $HOME_NET any -> 182.255.45.114 4848 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5456f579674a55acf4bcc2b46ec6a5cbc9b270f12f147b6e8a5972fea578ffde"; reference:url,publicmosaic.com/indicators; sid:9100455; rev:2;)