# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 159 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family pure-rat — https://publicmosaic.com/c2/pure-rat
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 5.175.182.184 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a7dc431180e155cf3e1427171d829e0ccb257f5f7a02c941114e1dd1fdaca368"; reference:url,publicmosaic.com/indicators; sid:9101588; rev:2;)
alert tls $HOME_NET any -> 5.230.201.54 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101291; rev:2;)
alert tls $HOME_NET any -> 5.230.201.54 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101587; rev:2;)
alert tls $HOME_NET any -> 5.230.201.54 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101586; rev:2;)
alert tls $HOME_NET any -> 13.205.246.212 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e7987fdd4a790d1e28293f93b21ee30159e255b59aff1001ba0bef3832ad65a7"; reference:url,publicmosaic.com/indicators; sid:9101560; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fd9da0342e433f4b9ba85d1b617a325cd9b658a5a8ea0b7810a29d4a1678d256"; reference:url,publicmosaic.com/indicators; sid:9101250; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101247; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101245; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101244; rev:2;)
alert tls $HOME_NET any -> 27.124.36.136 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101559; rev:2;)
alert tls $HOME_NET any -> 27.124.36.151 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101551; rev:2;)
alert tls $HOME_NET any -> 31.57.38.7 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6c2f3547c0285f4a25eb3fa79f7479dd89a6e6cfb27f7aa5f12447979fa79fed"; reference:url,publicmosaic.com/indicators; sid:9101321; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105543; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105542; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105541; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c5e50ab52aa49f2474e5df2aa15e98a3c64705c6aa89f7ae3ee67a1469873a4f"; reference:url,publicmosaic.com/indicators; sid:9101285; rev:2;)
alert tls $HOME_NET any -> 31.57.219.139 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"8f9157c3c543ea5a0dcec829f606c5fc957c0055cabef20eacc5824ea69aea6b"; reference:url,publicmosaic.com/indicators; sid:9101284; rev:2;)
alert tls $HOME_NET any -> 31.76.125.10 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5ac9795c24d7114fac1dcbd58e9a8e35a86c9a0daa6eb960049cd5fbb47ec735"; reference:url,publicmosaic.com/indicators; sid:9101750; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106075; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106074; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9104688; rev:2;)
alert tls $HOME_NET any -> 38.240.48.155 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"30b227a2b7f36040f67a3851f2b5de331b6e6241e910c414a3a4e6aa760b8599"; reference:url,publicmosaic.com/indicators; sid:9101277; rev:2;)
alert tls $HOME_NET any -> 38.240.48.155 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7f1cc9f4b534eda288c7a1de2a45ba41497ad6d47443e6f552f0603816f304f"; reference:url,publicmosaic.com/indicators; sid:9101283; rev:2;)
alert tls $HOME_NET any -> 38.240.57.198 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c6fe42595f5b0a97dc4c7623ab48ed5ad5f10febac0aeed00835be7a423afbf1"; reference:url,publicmosaic.com/indicators; sid:9101549; rev:2;)
alert tls $HOME_NET any -> 43.135.26.173 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"9f904b1aef85ae53cf55bcfff4e1b8b20e2708156e075d1922b2e5528372c9f9"; reference:url,publicmosaic.com/indicators; sid:9101558; rev:2;)
alert tcp $HOME_NET any -> 43.135.26.173 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106467; rev:2;)
alert tls $HOME_NET any -> 45.9.12.6 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"44b742f440956a0d6aa87fd3efc672462d3e85667f16706706385722d86c1ff1"; reference:url,publicmosaic.com/indicators; sid:9101249; rev:2;)
alert tls $HOME_NET any -> 45.11.230.111 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e6e9e62afecbf07a1160ba4d0bf7bee7aebb8e5465ded5c4af683fc81146a3b2"; reference:url,publicmosaic.com/indicators; sid:9105131; rev:2;)
alert tls $HOME_NET any -> 45.11.230.111 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e6e9e62afecbf07a1160ba4d0bf7bee7aebb8e5465ded5c4af683fc81146a3b2"; reference:url,publicmosaic.com/indicators; sid:9105129; rev:2;)
alert tls $HOME_NET any -> 45.139.104.26 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"cec2240638f946f07575c857f2b616d3859203ea308e52bca8618010d5e0e579"; reference:url,publicmosaic.com/indicators; sid:9106832; rev:2;)
alert tls $HOME_NET any -> 45.139.104.204 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"88cc822004271b517410718f9352af88d65feb760a8f5d5fa53a4847b2c0ef0a"; reference:url,publicmosaic.com/indicators; sid:9105816; rev:2;)
alert tls $HOME_NET any -> 45.139.104.226 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1d3ad35b189a89c1095e0a3e710204b603ef3efa942e93f413a314d904c90307"; reference:url,publicmosaic.com/indicators; sid:9104685; rev:2;)
alert tls $HOME_NET any -> 45.139.104.226 49001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"4c12dd5cd3dbf519f29501e4cf4909ba20b8af456b37e0f9c6c7f08d68211de4"; reference:url,publicmosaic.com/indicators; sid:9105128; rev:2;)
alert tls $HOME_NET any -> 45.149.153.23 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f23699e931169efa2fc830510dc356bc1a7953903538fef6b8508d73a86a4f38"; reference:url,publicmosaic.com/indicators; sid:9101557; rev:2;)
alert tcp $HOME_NET any -> 45.192.211.116 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106466; rev:2;)
alert tcp $HOME_NET any -> 45.192.211.116 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106465; rev:2;)
alert tls $HOME_NET any -> 45.192.211.116 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1adca882e4c5aad436a77549adf345a0750496407b605ec42e3f38bef6440217"; reference:url,publicmosaic.com/indicators; sid:9106071; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.54 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106464; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.54 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106463; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106462; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106461; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106460; rev:2;)
alert tcp $HOME_NET any -> 45.192.226.20 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106459; rev:2;)
alert tcp $HOME_NET any -> 45.192.226.20 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106458; rev:2;)
alert tls $HOME_NET any -> 45.225.135.156 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3413a3502c09913410c076cd0a5c0b17d86c9bfb4faaa9c7faf3f9ac381148e5"; reference:url,publicmosaic.com/indicators; sid:9101439; rev:2;)
alert tls $HOME_NET any -> 51.79.169.74 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"183617c661031ff658c324e9695e63c48a5ac0776f607717ce4d50aef35bd102"; reference:url,publicmosaic.com/indicators; sid:9101556; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"2fb1c213ec4dd6f2a63ecf3d3d300e056142872db89da0c361640602f2849b95"; reference:url,publicmosaic.com/indicators; sid:9101248; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b45ea1d96442c5956fe49f01d830e8787004ada764870a2a79c959247223f62a"; reference:url,publicmosaic.com/indicators; sid:9101289; rev:2;)
alert tls $HOME_NET any -> 66.179.29.5 2000 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7ee97a771e202ee1db01a20e35437228a44486e1e9166b41c2cccbf388fd5588"; reference:url,publicmosaic.com/indicators; sid:9103943; rev:2;)
alert tls $HOME_NET any -> 66.179.29.5 5000 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7ee97a771e202ee1db01a20e35437228a44486e1e9166b41c2cccbf388fd5588"; reference:url,publicmosaic.com/indicators; sid:9103942; rev:2;)
alert tls $HOME_NET any -> 77.83.39.141 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6402d7b969b86630b4342abcba4010606690ccb1bf1a2ec167079cdf82caf59a"; reference:url,publicmosaic.com/indicators; sid:9104050; rev:2;)
alert tls $HOME_NET any -> 80.96.109.107 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a3178e2eb85f30f2065d7f014a88192c7b9cbe5ff7c21f8d44e90b0ffc63ec70"; reference:url,publicmosaic.com/indicators; sid:9101555; rev:2;)
alert tls $HOME_NET any -> 83.136.211.230 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0fe191a35af005d19fa6b9e257e3116e9f84227afa8a49b969e4e288b6ffe200"; reference:url,publicmosaic.com/indicators; sid:9105815; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"44e8cd1d92caa289781f5b9b7a7dc6993f4fd8cfae729d193b6685f4c7227767"; reference:url,publicmosaic.com/indicators; sid:9101554; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ecb28dd1de46b0e824cd4144ee1e8e5c0f247ca8184f67b058f8e56e68b43010"; reference:url,publicmosaic.com/indicators; sid:9101466; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ecb28dd1de46b0e824cd4144ee1e8e5c0f247ca8184f67b058f8e56e68b43010"; reference:url,publicmosaic.com/indicators; sid:9101465; rev:2;)
alert tls $HOME_NET any -> 91.92.40.209 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"010ada05fc48381615e3d71240853d36c22143b42c8b0f23cfa342b1cba309a8"; reference:url,publicmosaic.com/indicators; sid:9101288; rev:2;)
alert tls $HOME_NET any -> 91.92.243.36 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"4a172c28e3ea3f86d93aec642d017b528414ca3f6ca2959ed03238b1a43c5d97"; reference:url,publicmosaic.com/indicators; sid:9101436; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106454; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106453; rev:2;)
alert tcp $HOME_NET any -> 91.92.243.114 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106452; rev:2;)
alert tls $HOME_NET any -> 91.219.239.100 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"14d65bb835dd1ee373290d1e2293dda4b76e1115b166a88d46c0e7f4ef31fcf7"; reference:url,publicmosaic.com/indicators; sid:9105126; rev:2;)
alert tls $HOME_NET any -> 94.143.231.61 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"67d32b82de0af1b80508098339e2385a5fa2dc62ef50718c79a17bc48d668ec5"; reference:url,publicmosaic.com/indicators; sid:9101552; rev:2;)
alert tls $HOME_NET any -> 94.228.166.168 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04f1d68c498c75ff5f897624d435129470e9c9c0a2260575a0df3914a5046e05"; reference:url,publicmosaic.com/indicators; sid:9101435; rev:2;)
alert tls $HOME_NET any -> 94.228.166.168 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04f1d68c498c75ff5f897624d435129470e9c9c0a2260575a0df3914a5046e05"; reference:url,publicmosaic.com/indicators; sid:9101434; rev:2;)
alert tls $HOME_NET any -> 95.133.229.173 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"bfc794ba655afc4e90d4209a0e1c29d02b00588a059d429e93c3676a5822e85c"; reference:url,publicmosaic.com/indicators; sid:9101246; rev:2;)
alert tls $HOME_NET any -> 95.133.229.173 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c0a3a13b2a0aa3013fa37c2dc34c2fce4f631e6730a394b7c01d081dd24fd616"; reference:url,publicmosaic.com/indicators; sid:9101464; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"63bfe77fd83ff334a9be0cfadb4912ab923d801a6ff0f0e54c63abd4e2bcd788"; reference:url,publicmosaic.com/indicators; sid:9101714; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101667; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101666; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101665; rev:2;)
alert tls $HOME_NET any -> 104.143.46.142 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fac3af053b268e18b02096cda89efc028024c08caac73e86f337397b4857cef0"; reference:url,publicmosaic.com/indicators; sid:9104044; rev:2;)
alert tls $HOME_NET any -> 104.143.46.142 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fac3af053b268e18b02096cda89efc028024c08caac73e86f337397b4857cef0"; reference:url,publicmosaic.com/indicators; sid:9104043; rev:2;)
alert tls $HOME_NET any -> 104.254.90.162 28471 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7f176319f7a4637f8d22e3478559eb4e81f28a1c3e5245d95bfa58314d23f2c7"; reference:url,publicmosaic.com/indicators; sid:9101658; rev:2;)
alert tls $HOME_NET any -> 107.149.8.58 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"14ce09b7ce7c2445d37af4a0e979f1d140924180252415a87d527417b601f681"; reference:url,publicmosaic.com/indicators; sid:9105545; rev:2;)
alert tls $HOME_NET any -> 107.150.72.199 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"90c533364b293892c2b24c8b75871d9de1c61040725a249816b845e98b1f817f"; reference:url,publicmosaic.com/indicators; sid:9106469; rev:2;)
alert tls $HOME_NET any -> 108.59.244.106 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a2faa5fd368e7f70c2dbb296bec61988ca4d4eea72ce2b76f31a6099076b2ac8"; reference:url,publicmosaic.com/indicators; sid:9101743; rev:2;)
alert tcp $HOME_NET any -> 118.107.16.32 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106473; rev:2;)
alert tcp $HOME_NET any -> 118.107.16.32 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106472; rev:2;)
alert tls $HOME_NET any -> 125.62.77.141 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"82aeafab427674c4ab36f5483a6ee136e1bc25c326ce1c04d5abd74722332493"; reference:url,publicmosaic.com/indicators; sid:9101294; rev:2;)
alert tls $HOME_NET any -> 130.12.182.209 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5302cab2f9d10dcc497458d27d68febeb8f0254a657eac08f984b1bbee9a84b7"; reference:url,publicmosaic.com/indicators; sid:9101243; rev:2;)
alert tls $HOME_NET any -> 135.84.210.197 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"54aa6b7e3de7a9503a2ee0cdeec4c601bdfa5712efd7496dece7f2eeadd64907"; reference:url,publicmosaic.com/indicators; sid:9105811; rev:2;)
alert tls $HOME_NET any -> 135.136.147.86 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"86d47eb3aa48cc86a4ef10c35d4ff4f06073fc9abb93d82241163bf9a53fb57d"; reference:url,publicmosaic.com/indicators; sid:9101550; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101569; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101568; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101181; rev:2;)
alert tls $HOME_NET any -> 144.31.6.0 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3362b443a7a08bb5e9fb7d50656faae9955d321f60e006c403dd8f24c5259ac2"; reference:url,publicmosaic.com/indicators; sid:9101640; rev:2;)
alert tls $HOME_NET any -> 144.31.6.6 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"82be34eaea2d8b8e3b282002ecb882d9fc4c6c1fa790b8cb9ee3b4173e000c8f"; reference:url,publicmosaic.com/indicators; sid:9101335; rev:2;)
alert tls $HOME_NET any -> 144.31.6.21 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"9e184c9ccdd5133d25325cb5f9252a8de8864e4702c0a8a5fd93671e1678b725"; reference:url,publicmosaic.com/indicators; sid:9101287; rev:2;)
alert tls $HOME_NET any -> 144.172.112.126 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5124da47575f119eb08488e54f896960a7662e89329d61df30b5b4fbfd3e2a18"; reference:url,publicmosaic.com/indicators; sid:9105814; rev:2;)
alert tls $HOME_NET any -> 148.66.5.59 4443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3cc75ff995302462eb0fa4f074743f142c1b0d2d3ceb81b8292cc792cbba679f"; reference:url,publicmosaic.com/indicators; sid:9105779; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101233; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101229; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101224; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101222; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101231; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101227; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101223; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101226; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101225; rev:2;)
alert tls $HOME_NET any -> 158.94.211.158 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"39ba16f179f41d46df324d28c145fab29abb288bf3fb09270baf3ce724ab9686"; reference:url,publicmosaic.com/indicators; sid:9105813; rev:2;)
alert tls $HOME_NET any -> 168.222.97.92 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"31181115b28e0ecf1ca51a78830214e764458c95c9f0bf6f21141b9f45e5d474"; reference:url,publicmosaic.com/indicators; sid:9101332; rev:2;)
alert tls $HOME_NET any -> 172.81.132.75 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a53c65b5aa30d59a8cef7743b05a3adc4de374296251ebf4e697d7dfd94236c2"; reference:url,publicmosaic.com/indicators; sid:9101553; rev:2;)
alert tls $HOME_NET any -> 172.86.122.177 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"92653bf7b73322a4c4805f601adc31fae9c37d2fe9330606ede41d3516c5506b"; reference:url,publicmosaic.com/indicators; sid:9101329; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 3001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101232; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56011 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101228; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56012 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101230; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56013 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101638; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"29c4cb19385a4e410c03cec1a982527a09352afd2cf6bdd20c1e607d8ae1687b"; reference:url,publicmosaic.com/indicators; sid:9101242; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101235; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101236; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101234; rev:2;)
alert tls $HOME_NET any -> 178.16.55.133 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a68234874e32dda82ae90383b731cb4c0e6d53737059876b1f979cea13d02a73"; reference:url,publicmosaic.com/indicators; sid:9101286; rev:2;)
alert tls $HOME_NET any -> 178.211.155.154 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e5dad5b46de9afa31d9effe7e3e5b67d251ced9f66a595e15caec37b6bdb9c9"; reference:url,publicmosaic.com/indicators; sid:9101548; rev:2;)
alert tls $HOME_NET any -> 183.90.187.2 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101170; rev:2;)
alert tls $HOME_NET any -> 183.90.187.73 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101171; rev:2;)
alert tls $HOME_NET any -> 183.90.187.111 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101172; rev:2;)
alert tls $HOME_NET any -> 185.112.59.115 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ac956e6e99b48da03270a69d809bd13d90150391812527785a39118ede97bae7"; reference:url,publicmosaic.com/indicators; sid:9101518; rev:2;)
alert tls $HOME_NET any -> 185.174.102.5 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"59894e7c37cac9f0fa21ce41fbd7b9f2f247235dc14ed91af124e3a262924457"; reference:url,publicmosaic.com/indicators; sid:9105812; rev:2;)
alert tls $HOME_NET any -> 185.198.58.107 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"31905a421acc8f2d3b45e6ba7066163aecc0f5c9d325357d37323fa5146e2b0a"; reference:url,publicmosaic.com/indicators; sid:9101169; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101167; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101159; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101162; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101165; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101158; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101166; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101154; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101160; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101156; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101164; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101163; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101161; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101157; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101155; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101153; rev:2;)
alert tls $HOME_NET any -> 194.9.6.35 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3413a3502c09913410c076cd0a5c0b17d86c9bfb4faaa9c7faf3f9ac381148e5"; reference:url,publicmosaic.com/indicators; sid:9101276; rev:2;)
alert tls $HOME_NET any -> 194.9.6.35 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3413a3502c09913410c076cd0a5c0b17d86c9bfb4faaa9c7faf3f9ac381148e5"; reference:url,publicmosaic.com/indicators; sid:9101275; rev:2;)
alert tls $HOME_NET any -> 194.9.6.125 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5c7ce74a655bedb8cc15d2d809842cfa546bac3cfd5ba6000e06bc6d9f98724"; reference:url,publicmosaic.com/indicators; sid:9101239; rev:2;)
alert tls $HOME_NET any -> 194.62.248.129 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6888b21a76b261e0d76b1b57a7435c95f0738ac992ad94044364b0aa77d4342d"; reference:url,publicmosaic.com/indicators; sid:9105810; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101756; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101755; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101754; rev:2;)
alert tls $HOME_NET any -> 196.251.121.124 2008 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ccbbd0434e23ffd0e69dc9422c08fb63a00c6c38b78bb65fbd79a63b06cf1d85"; reference:url,publicmosaic.com/indicators; sid:9101753; rev:2;)
alert tls $HOME_NET any -> 196.251.121.124 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ccbbd0434e23ffd0e69dc9422c08fb63a00c6c38b78bb65fbd79a63b06cf1d85"; reference:url,publicmosaic.com/indicators; sid:9101280; rev:2;)
alert tls $HOME_NET any -> 199.231.191.3 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c64f6cc6be61f55d429456af05dc436956f353bf4d99bde0864d58550acc591e"; reference:url,publicmosaic.com/indicators; sid:9101567; rev:2;)
alert tls $HOME_NET any -> 202.155.9.186 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"706dab2df64822292b58d506cc5c1efc0b3c964970c3f24d9963d9743bd36235"; reference:url,publicmosaic.com/indicators; sid:9101325; rev:2;)
alert tls $HOME_NET any -> 203.159.90.177 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"269bc90b83c85ac50349794fa6a2a9a0ec1d0909ea87b2808a3fc6b13cd6fe3b"; reference:url,publicmosaic.com/indicators; sid:9101241; rev:2;)
alert tls $HOME_NET any -> 203.159.90.177 55006 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c43566595e58b5ca38a4f089e1f7958ec57f78d5637496e5d288dc2c97d40f64"; reference:url,publicmosaic.com/indicators; sid:9101517; rev:2;)
alert tls $HOME_NET any -> 203.202.232.132 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fc3e249f91faee6fdbcb53a47242a045a5d8d5a1532b02fc4db29ce28fcdda4c"; reference:url,publicmosaic.com/indicators; sid:9101240; rev:2;)
alert tls $HOME_NET any -> 209.99.186.142 55009 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ef3dd28f183d18a8675402c8d3d238a066af26797351db0f6799a0ff50bbf8d9"; reference:url,publicmosaic.com/indicators; sid:9101324; rev:2;)
alert tls $HOME_NET any -> 217.60.102.3 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e919324123345f95ef70e39edc18cd08fdf9a6c40c1bb6a7bdc44dd702a32ddf"; reference:url,publicmosaic.com/indicators; sid:9101323; rev:2;)
alert tls $HOME_NET any -> 217.60.102.3 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e919324123345f95ef70e39edc18cd08fdf9a6c40c1bb6a7bdc44dd702a32ddf"; reference:url,publicmosaic.com/indicators; sid:9101322; rev:2;)
alert tls $HOME_NET any -> 217.60.195.89 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7f176319f7a4637f8d22e3478559eb4e81f28a1c3e5245d95bfa58314d23f2c7"; reference:url,publicmosaic.com/indicators; sid:9101150; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"aae970e704d6970354b12c3f834b00f8d56d4857afa66886161d8017b95ea58b"; reference:url,publicmosaic.com/indicators; sid:9101470; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101469; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101468; rev:2;)
alert tls $HOME_NET any -> 217.60.195.139 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"47adc6a64c0a1250e177abcbff7b2004a0d83b1a787974086c15711d233b358f"; reference:url,publicmosaic.com/indicators; sid:9101238; rev:2;)
alert tls $HOME_NET any -> 217.60.195.193 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f4be79a934eececfb72d0d2252478b2d1272d77343ea065c55bf902c3d4482ba"; reference:url,publicmosaic.com/indicators; sid:9104161; rev:2;)
alert tls $HOME_NET any -> 217.60.195.226 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04ed4773b612b28ee230eae5e973803354488ea22a7fa31f15408694c80d14b6"; reference:url,publicmosaic.com/indicators; sid:9104160; rev:2;)