# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 277 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family asyncrat — https://publicmosaic.com/c2/asyncrat
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 3.76.202.212 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104175; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104099; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104174; rev:2;)
alert tcp $HOME_NET any -> 3.76.202.212 9999 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104098; rev:2;)
alert tcp $HOME_NET any -> 3.113.147.16 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101149; rev:2;)
alert tcp $HOME_NET any -> 5.21.239.104 1723 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106016; rev:2;)
alert tcp $HOME_NET any -> 8.222.217.251 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103674; rev:2;)
alert tcp $HOME_NET any -> 12.187.175.73 8797 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102179; rev:2;)
alert tcp $HOME_NET any -> 12.202.180.13 6745 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104515; rev:2;)
alert tls $HOME_NET any -> 13.236.153.60 8888 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"472dcc1ee4acfca148d051ebec7c9582ff4b27413d590c59805a7fac5f93d0b7"; reference:url,publicmosaic.com/indicators; sid:9103656; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"d68747dafe52de70247a0710f4db9542d020ecfe9a029615dc5833d4405b19a6"; reference:url,publicmosaic.com/indicators; sid:9100592; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 2502 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102178; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 2503 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102177; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 2504 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102176; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 2505 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102175; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101237; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 7005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102174; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 7007 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"d68747dafe52de70247a0710f4db9542d020ecfe9a029615dc5833d4405b19a6"; reference:url,publicmosaic.com/indicators; sid:9100849; rev:2;)
alert tcp $HOME_NET any -> 31.57.184.154 7008 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102173; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"d68747dafe52de70247a0710f4db9542d020ecfe9a029615dc5833d4405b19a6"; reference:url,publicmosaic.com/indicators; sid:9100779; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"d68747dafe52de70247a0710f4db9542d020ecfe9a029615dc5833d4405b19a6"; reference:url,publicmosaic.com/indicators; sid:9100848; rev:2;)
alert tcp $HOME_NET any -> 31.70.81.171 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102172; rev:2;)
alert tls $HOME_NET any -> 31.70.81.171 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100778; rev:2;)
alert tls $HOME_NET any -> 31.70.81.171 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100027; rev:2;)
alert tls $HOME_NET any -> 34.45.74.63 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100156; rev:2;)
alert tcp $HOME_NET any -> 34.186.150.169 6932 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103648; rev:2;)
alert tcp $HOME_NET any -> 36.255.97.175 4445 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105698; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 4212 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102171; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 6066 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102170; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102169; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102168; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 8088 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102167; rev:2;)
alert tcp $HOME_NET any -> 37.72.172.58 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102166; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 3200 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102165; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4445 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102164; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4465 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102163; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 4655 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104993; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 5505 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102162; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 5551 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104992; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 7575 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102161; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100846; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100845; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102160; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100844; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8087 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100842; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8090 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102159; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8091 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102158; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8282 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102157; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 8880 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100840; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8881 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102156; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 8907 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102155; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100839; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9090 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100843; rev:2;)
alert tls $HOME_NET any -> 38.247.165.127 9909 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"0fce84827d8c922590395a80484d9841f7f2071a6c807573adcfdb168a43c430"; reference:url,publicmosaic.com/indicators; sid:9100841; rev:2;)
alert tcp $HOME_NET any -> 38.247.165.127 9919 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102154; rev:2;)
alert tls $HOME_NET any -> 41.234.45.136 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"afa5400177a6ae23068369b5dc2c4457c98a26b9c6aa267dd7a3664bfbe5e103"; reference:url,publicmosaic.com/indicators; sid:9100799; rev:2;)
alert tcp $HOME_NET any -> 43.98.252.110 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103673; rev:2;)
alert tcp $HOME_NET any -> 43.228.157.252 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102153; rev:2;)
alert tcp $HOME_NET any -> 45.64.52.70 4040 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103672; rev:2;)
alert tcp $HOME_NET any -> 45.64.52.82 4040 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103647; rev:2;)
alert tls $HOME_NET any -> 45.131.182.88 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100148; rev:2;)
alert tls $HOME_NET any -> 45.131.182.88 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100147; rev:2;)
alert tls $HOME_NET any -> 45.131.182.88 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100146; rev:2;)
alert tls $HOME_NET any -> 45.141.21.167 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"308a3a758759743c7bca8e016d1b45dff1b76a8e24875d42fb59916fc38fb8ae"; reference:url,publicmosaic.com/indicators; sid:9104071; rev:2;)
alert tcp $HOME_NET any -> 45.141.21.167 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104070; rev:2;)
alert tcp $HOME_NET any -> 45.141.21.167 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103984; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.16 1011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102152; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.16 2202 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102151; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.205 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102150; rev:2;)
alert tcp $HOME_NET any -> 47.236.1.187 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101310; rev:2;)
alert tcp $HOME_NET any -> 47.236.113.37 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103671; rev:2;)
alert tcp $HOME_NET any -> 47.236.122.197 8443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103670; rev:2;)
alert tls $HOME_NET any -> 52.29.243.233 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100767; rev:2;)
alert tcp $HOME_NET any -> 52.196.79.161 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101140; rev:2;)
alert tcp $HOME_NET any -> 54.199.206.9 21672 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101137; rev:2;)
alert tcp $HOME_NET any -> 62.85.42.217 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106065; rev:2;)
alert tcp $HOME_NET any -> 62.171.148.175 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106730; rev:2;)
alert tcp $HOME_NET any -> 62.171.148.175 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106628; rev:2;)
alert tls $HOME_NET any -> 64.89.163.114 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9103760; rev:2;)
alert tcp $HOME_NET any -> 64.177.41.198 6666 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101646; rev:2;)
alert tcp $HOME_NET any -> 64.177.41.198 8888 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101645; rev:2;)
alert tls $HOME_NET any -> 64.177.112.21 50 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9101634; rev:2;)
alert tcp $HOME_NET any -> 67.210.97.40 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102149; rev:2;)
alert tcp $HOME_NET any -> 67.210.97.40 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102148; rev:2;)
alert tcp $HOME_NET any -> 67.210.97.40 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102147; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100140; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 700 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103832; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1000 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102146; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101745; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102145; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1003 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102144; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1004 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102143; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102142; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1006 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102141; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1007 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102140; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1008 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102139; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102138; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1010 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102137; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 1111 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102136; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100138; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102135; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102134; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2003 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100139; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2004 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100129; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102133; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2020 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102132; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2025 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102131; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 2222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100130; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 2414 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101336; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 5005 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102130; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 6006 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100135; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103831; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 7007 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100132; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100765; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 8008 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102129; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102128; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 9009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102127; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 9909 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100137; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102126; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106201; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 10700 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101197; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20100 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102125; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20300 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102124; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102123; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103830; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 20700 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100136; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 20800 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101642; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 30100 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103829; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 30200 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106200; rev:2;)
alert tls $HOME_NET any -> 80.190.77.86 30700 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100134; rev:2;)
alert tcp $HOME_NET any -> 80.190.77.86 30900 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102122; rev:2;)
alert tls $HOME_NET any -> 82.65.19.134 4443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"73256482e7051488d52e489abb9e3aa77dd8367953b39855f8d4eab71102b842"; reference:url,publicmosaic.com/indicators; sid:9100591; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106575; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 6661 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106729; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 8115 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106728; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 9011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106727; rev:2;)
alert tcp $HOME_NET any -> 84.247.187.47 9990 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106726; rev:2;)
alert tls $HOME_NET any -> 85.8.149.156 444 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"ed67f73eeb26e22113967bd26de00a8eea6580a6c2db5937bf2fdf86d86920fa"; reference:url,publicmosaic.com/indicators; sid:9100590; rev:2;)
alert tcp $HOME_NET any -> 86.48.16.94 3200 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102121; rev:2;)
alert tcp $HOME_NET any -> 86.48.16.94 30100 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102120; rev:2;)
alert tcp $HOME_NET any -> 91.219.239.81 972 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101437; rev:2;)
alert tcp $HOME_NET any -> 93.233.109.96 51123 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104078; rev:2;)
alert tcp $HOME_NET any -> 93.233.109.96 51124 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106725; rev:2;)
alert tcp $HOME_NET any -> 93.233.109.96 51125 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104242; rev:2;)
alert tls $HOME_NET any -> 101.99.92.134 4788 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"ea6fe379d575afaeccb455557abe201a85d49de507a684bd1bbc52d25460cb38"; reference:url,publicmosaic.com/indicators; sid:9100126; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 1505 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102119; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 1506 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102118; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2025 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102117; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2026 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105551; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 2027 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101735; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105550; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 2600 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104241; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 3500 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102116; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 5222 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101585; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5333 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101631; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5444 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101630; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 5555 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102115; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102114; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 6666 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102113; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 7001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101570; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102112; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101734; rev:2;)
alert tls $HOME_NET any -> 102.220.160.198 8888 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"65a8ef64e5d7757cf017fd80952c1fdd65c96fd3ca295a460ca98c6d2a3c39a5"; reference:url,publicmosaic.com/indicators; sid:9101715; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56001 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102111; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56002 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104695; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.198 56003 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102110; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.250 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106724; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.250 7829 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102109; rev:2;)
alert tcp $HOME_NET any -> 102.220.161.94 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106446; rev:2;)
alert tcp $HOME_NET any -> 103.206.216.183 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103669; rev:2;)
alert tcp $HOME_NET any -> 103.206.216.183 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103668; rev:2;)
alert tcp $HOME_NET any -> 103.206.216.183 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103667; rev:2;)
alert tls $HOME_NET any -> 103.237.92.116 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"4ee36a39737b59d36e0c1f9879f13588bc210fbe2f938b37f58ac0c12f8dc972"; reference:url,publicmosaic.com/indicators; sid:9101712; rev:2;)
alert tcp $HOME_NET any -> 103.237.92.116 8338 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103871; rev:2;)
alert tcp $HOME_NET any -> 104.250.161.126 2061 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102108; rev:2;)
alert tls $HOME_NET any -> 105.155.16.5 5001 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100723; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100112; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100114; rev:2;)
alert tls $HOME_NET any -> 107.173.47.158 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100113; rev:2;)
alert tls $HOME_NET any -> 107.175.88.79 30305 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100111; rev:2;)
alert tcp $HOME_NET any -> 115.75.66.68 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106723; rev:2;)
alert tcp $HOME_NET any -> 115.75.66.68 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106290; rev:2;)
alert tls $HOME_NET any -> 121.200.216.84 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a044f704598dcdadfe1346c03cc5880c670c5f4cf5efcc86186fbb7b8fbfe022"; reference:url,publicmosaic.com/indicators; sid:9100850; rev:2;)
alert tcp $HOME_NET any -> 139.95.25.171 443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103666; rev:2;)
alert tcp $HOME_NET any -> 139.95.26.122 443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101317; rev:2;)
alert tcp $HOME_NET any -> 155.94.150.221 6745 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104449; rev:2;)
alert tcp $HOME_NET any -> 155.94.163.75 8797 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102107; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 1337 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100589; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 1338 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103804; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 1339 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102106; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 1444 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103905; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 1973 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100172; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 1995 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103904; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 1996 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103903; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 1997 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100170; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 1998 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100171; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.21 4442 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103902; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 4443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100586; rev:2;)
alert tls $HOME_NET any -> 157.20.182.21 4444 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100587; rev:2;)
alert tls $HOME_NET any -> 157.20.182.22 1337 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100749; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.22 1339 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102105; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.22 1998 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102104; rev:2;)
alert tcp $HOME_NET any -> 157.20.182.22 4442 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102103; rev:2;)
alert tls $HOME_NET any -> 157.20.182.22 4443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100751; rev:2;)
alert tls $HOME_NET any -> 157.20.182.22 4444 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100750; rev:2;)
alert tls $HOME_NET any -> 157.20.182.22 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100758; rev:2;)
alert tcp $HOME_NET any -> 158.94.209.209 3009 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105863; rev:2;)
alert tls $HOME_NET any -> 160.25.140.132 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"78f51753bbfb30948087e8f1e087f2f73f923c6dbed25e1b3625469b0b1dc22f"; reference:url,publicmosaic.com/indicators; sid:9100875; rev:2;)
alert tls $HOME_NET any -> 160.25.140.133 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"78f51753bbfb30948087e8f1e087f2f73f923c6dbed25e1b3625469b0b1dc22f"; reference:url,publicmosaic.com/indicators; sid:9100874; rev:2;)
alert tcp $HOME_NET any -> 160.119.69.30 5555 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101334; rev:2;)
alert tcp $HOME_NET any -> 160.191.88.70 44556 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104901; rev:2;)
alert tcp $HOME_NET any -> 162.35.112.239 7766 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106433; rev:2;)
alert tcp $HOME_NET any -> 163.245.215.235 8848 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104077; rev:2;)
alert tcp $HOME_NET any -> 167.253.157.140 443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103612; rev:2;)
alert tcp $HOME_NET any -> 169.58.180.142 30300 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104520; rev:2;)
alert tcp $HOME_NET any -> 169.58.180.142 30400 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104519; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 69 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102102; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 70 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102101; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 71 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102100; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 72 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102099; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 73 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102098; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 75 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102097; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 76 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102096; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 77 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102095; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 79 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102094; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106722; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.103 191 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102093; rev:2;)
alert tcp $HOME_NET any -> 175.210.184.125 5000 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102092; rev:2;)
alert tcp $HOME_NET any -> 175.210.184.125 8000 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102091; rev:2;)
alert tcp $HOME_NET any -> 176.149.202.136 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105301; rev:2;)
alert tcp $HOME_NET any -> 176.149.202.136 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105300; rev:2;)
alert tcp $HOME_NET any -> 176.149.202.136 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105299; rev:2;)
alert tcp $HOME_NET any -> 182.253.155.153 10549 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102090; rev:2;)
alert tls $HOME_NET any -> 185.34.147.31 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9100089; rev:2;)
alert tls $HOME_NET any -> 185.34.147.31 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101725; rev:2;)
alert tls $HOME_NET any -> 185.34.147.32 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101726; rev:2;)
alert tls $HOME_NET any -> 185.34.147.33 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9100088; rev:2;)
alert tls $HOME_NET any -> 185.34.147.33 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101724; rev:2;)
alert tls $HOME_NET any -> 185.34.147.34 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9100086; rev:2;)
alert tls $HOME_NET any -> 185.34.147.34 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101721; rev:2;)
alert tls $HOME_NET any -> 185.34.147.35 80 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9100085; rev:2;)
alert tls $HOME_NET any -> 185.34.147.35 8080 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101719; rev:2;)
alert tcp $HOME_NET any -> 185.157.46.242 1337 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9104900; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.83 9909 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103610; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.250 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106289; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.250 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106288; rev:2;)
alert tcp $HOME_NET any -> 186.169.88.130 5010 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102089; rev:2;)
alert tcp $HOME_NET any -> 186.169.88.130 5011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102088; rev:2;)
alert tcp $HOME_NET any -> 186.169.88.130 5012 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102087; rev:2;)
alert tcp $HOME_NET any -> 186.169.88.130 8917 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102086; rev:2;)
alert tcp $HOME_NET any -> 186.169.88.130 9140 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102085; rev:2;)
alert tcp $HOME_NET any -> 188.212.158.203 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105100; rev:2;)
alert tcp $HOME_NET any -> 188.212.158.203 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101476; rev:2;)
alert tcp $HOME_NET any -> 190.102.41.198 7707 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103993; rev:2;)
alert tcp $HOME_NET any -> 190.102.41.198 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103992; rev:2;)
alert tls $HOME_NET any -> 191.93.118.254 9000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9100588; rev:2;)
alert tcp $HOME_NET any -> 192.252.176.72 2659 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103665; rev:2;)
alert tcp $HOME_NET any -> 194.26.192.124 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106287; rev:2;)
alert tcp $HOME_NET any -> 194.67.206.185 6547 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103664; rev:2;)
alert tcp $HOME_NET any -> 195.177.94.101 80 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101580; rev:2;)
alert tls $HOME_NET any -> 195.177.94.101 88 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"948542f77b7faa4e30dc5debb8787dc03ed79d149d0269bfc392f088ff277731"; reference:url,publicmosaic.com/indicators; sid:9101732; rev:2;)
alert tcp $HOME_NET any -> 195.177.94.101 110 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101654; rev:2;)
alert tcp $HOME_NET any -> 195.177.94.101 443 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101579; rev:2;)
alert tls $HOME_NET any -> 195.177.94.101 995 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"948542f77b7faa4e30dc5debb8787dc03ed79d149d0269bfc392f088ff277731"; reference:url,publicmosaic.com/indicators; sid:9101728; rev:2;)
alert tcp $HOME_NET any -> 195.177.94.101 8080 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9101653; rev:2;)
alert tls $HOME_NET any -> 196.64.147.116 5000 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9101731; rev:2;)
alert tls $HOME_NET any -> 196.64.147.116 5001 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9101730; rev:2;)
alert tls $HOME_NET any -> 196.64.147.116 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe"; reference:url,publicmosaic.com/indicators; sid:9101729; rev:2;)
alert tls $HOME_NET any -> 199.245.176.147 6606 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"f4a620ef339316c2fc7af1cb2fa9dd30041f2e435dfae333293e741789acdb9e"; reference:url,publicmosaic.com/indicators; sid:9100076; rev:2;)
alert tls $HOME_NET any -> 199.245.176.147 7707 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"f4a620ef339316c2fc7af1cb2fa9dd30041f2e435dfae333293e741789acdb9e"; reference:url,publicmosaic.com/indicators; sid:9100075; rev:2;)
alert tls $HOME_NET any -> 199.245.176.147 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"f4a620ef339316c2fc7af1cb2fa9dd30041f2e435dfae333293e741789acdb9e"; reference:url,publicmosaic.com/indicators; sid:9100074; rev:2;)
alert tcp $HOME_NET any -> 202.95.22.67 3863 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103663; rev:2;)
alert tcp $HOME_NET any -> 202.95.22.69 3863 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103662; rev:2;)
alert tcp $HOME_NET any -> 210.56.48.176 8808 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103615; rev:2;)
alert tcp $HOME_NET any -> 213.118.17.134 4444 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105298; rev:2;)
alert tcp $HOME_NET any -> 217.60.198.81 7744 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9106432; rev:2;)
alert tls $HOME_NET any -> 217.165.57.176 8808 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"41873f4a77782ec044d7446cee1ba73f911e02c788cc789d161b88f842a1f60c"; reference:url,publicmosaic.com/indicators; sid:9100157; rev:2;)