# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 303 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 9294 — https://publicmosaic.com/asn/9294
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.45.125.98 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103196; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.99 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103195; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.100 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103194; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.101 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103193; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.102 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103192; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.202 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105093; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.203 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105092; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.204 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103191; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.205 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105091; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.206 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105090; rev:2;)
alert tcp $HOME_NET any -> 45.197.36.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103068; rev:2;)
alert tcp $HOME_NET any -> 45.197.36.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103067; rev:2;)
alert tcp $HOME_NET any -> 103.101.176.234 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103658; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102834; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102833; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104657; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102832; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102831; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102830; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102829; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102828; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102827; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102826; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105897; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105899; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102825; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102824; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102823; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102820; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102822; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102821; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102331; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102330; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102819; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102818; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102817; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102815; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102816; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102814; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105908; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102329; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.50 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102328; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102813; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102812; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102811; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102810; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102809; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102806; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102805; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102804; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102803; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102783; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102792; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102779; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105903; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105898; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102782; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102799; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105905; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102798; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102781; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102784; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102790; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102797; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102786; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102780; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102787; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102796; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102791; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102795; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102785; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102327; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102326; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102793; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102788; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102778; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102789; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102325; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102324; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105902; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102323; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102322; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102321; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102320; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105875; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102319; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102318; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102317; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102316; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102315; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102314; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.40 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102777; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102794; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102801; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102802; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102800; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102776; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102775; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102774; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102773; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102761; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102770; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102772; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102313; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102312; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102771; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102766; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105882; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102311; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102310; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102309; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102308; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102307; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102306; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105879; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102305; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102304; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102303; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102302; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102301; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102300; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102754; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102769; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102299; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102298; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104656; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104655; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102768; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102767; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102765; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102753; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105880; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105885; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.41 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105873; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104654; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102297; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102296; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102295; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102759; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102762; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102755; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102751; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102748; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102750; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102763; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102764; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102752; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102757; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105891; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105892; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102760; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102756; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102749; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102758; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102747; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102746; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102745; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102744; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102743; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102742; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102741; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102740; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102739; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102738; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102294; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102293; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105925; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103601; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103600; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104653; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103599; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103598; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103597; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103596; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103595; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103594; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103593; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105920; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103592; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103591; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104652; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103590; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103589; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103588; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103587; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103586; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103585; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103584; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103583; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103582; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103581; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103579; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103580; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.55 8885 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104651; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104650; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104649; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103578; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103577; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103576; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103575; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103574; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103573; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105894; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105922; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103571; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103572; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103570; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103569; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103568; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103567; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103566; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.41 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103565; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103564; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103563; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103562; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103561; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103560; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103559; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105918; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103558; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103557; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105916; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105896; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103556; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103555; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105917; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105915; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105919; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105904; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103554; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103553; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105914; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105910; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103552; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103551; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103550; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103549; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105909; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105876; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103548; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103547; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103546; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103545; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103544; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103543; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103542; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103540; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105912; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105901; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105900; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103541; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103539; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103538; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103537; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103536; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103535; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103534; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103533; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103532; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103531; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103530; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103529; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103528; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103527; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103526; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103525; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105890; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103524; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103523; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103522; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103521; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103520; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103519; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105895; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.40 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103518; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103517; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105874; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105906; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103516; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103515; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105907; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103514; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103513; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103512; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103511; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103510; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.50 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103509; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103508; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103507; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102737; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102736; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105913; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102735; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102734; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103506; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103505; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103504; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103503; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102733; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102732; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105911; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103502; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103501; rev:2;)