# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 12 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family quasar-family — https://publicmosaic.com/c2/quasar-family
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 23.94.180.27 8880 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101662; rev:2;)
alert tls $HOME_NET any -> 45.133.174.134 56001 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"e8d55afae9657d627e69f2f858c30b604f3a09dec29fd33ce12b6f395c5a70ef"; reference:url,publicmosaic.com/indicators; sid:9104686; rev:2;)
alert tcp $HOME_NET any -> 45.207.193.193 1314 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9104513; rev:2;)
alert tls $HOME_NET any -> 65.108.231.245 443 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"f0e5edb6efbde650b993cab0d9abf392a6d7cbd0ab1c27544fefb38038fedaa2"; reference:url,publicmosaic.com/indicators; sid:9101309; rev:2;)
alert tls $HOME_NET any -> 81.68.249.199 1818 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"d106993302d81f68c31b1922c27dfde097d2313254eec754f8d6aafafe9bc1ec"; reference:url,publicmosaic.com/indicators; sid:9100036; rev:2;)
alert tcp $HOME_NET any -> 116.204.135.201 4449 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101664; rev:2;)
alert tcp $HOME_NET any -> 116.204.135.201 8848 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101663; rev:2;)
alert tcp $HOME_NET any -> 118.107.1.203 7878 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101858; rev:2;)
alert tcp $HOME_NET any -> 156.233.235.245 4449 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9103616; rev:2;)
alert tls $HOME_NET any -> 185.198.58.107 4782 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"71076723ae2f05059ca46b591229428640d2f730829da73478b7c916829b17a0"; reference:url,publicmosaic.com/indicators; sid:9105649; rev:2;)
alert tls $HOME_NET any -> 195.20.115.25 56001 (msg:"HOLLOWPOINT C2 quasar_family"; tls.cert_fingerprint; content:"064fab4bacbc260ec345debcd128fb29f4193572feaf1491f008fde0d9913b8b"; reference:url,publicmosaic.com/indicators; sid:9101746; rev:2;)
alert tcp $HOME_NET any -> 202.162.99.199 7878 (msg:"HOLLOWPOINT C2 quasar_family"; reference:url,publicmosaic.com/indicators; sid:9101856; rev:2;)