# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 2256 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family vshell — https://publicmosaic.com/c2/vshell
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.12.59.176 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102588; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 1098 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102587; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 3312 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105549; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8193 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106174; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102586; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104483; rev:2;)
alert tcp $HOME_NET any -> 1.13.19.103 8963 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102585; rev:2;)
alert tcp $HOME_NET any -> 1.13.91.59 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102584; rev:2;)
alert tcp $HOME_NET any -> 1.13.158.52 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103295; rev:2;)
alert tcp $HOME_NET any -> 1.13.179.86 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101001; rev:2;)
alert tcp $HOME_NET any -> 1.13.179.86 9876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101633; rev:2;)
alert tcp $HOME_NET any -> 1.13.251.23 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101000; rev:2;)
alert tcp $HOME_NET any -> 1.14.43.163 8082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104599; rev:2;)
alert tcp $HOME_NET any -> 1.14.43.163 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102583; rev:2;)
alert tcp $HOME_NET any -> 1.14.76.115 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106345; rev:2;)
alert tcp $HOME_NET any -> 1.14.103.5 18443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104598; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106344; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106343; rev:2;)
alert tcp $HOME_NET any -> 1.14.120.4 8804 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106416; rev:2;)
alert tcp $HOME_NET any -> 1.14.126.124 18083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102582; rev:2;)
alert tcp $HOME_NET any -> 1.14.191.194 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105547; rev:2;)
alert tcp $HOME_NET any -> 1.14.208.13 20000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102581; rev:2;)
alert tcp $HOME_NET any -> 1.15.179.110 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100999; rev:2;)
alert tcp $HOME_NET any -> 1.92.101.103 60000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103294; rev:2;)
alert tcp $HOME_NET any -> 1.94.176.236 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103293; rev:2;)
alert tcp $HOME_NET any -> 1.94.176.236 10001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103292; rev:2;)
alert tcp $HOME_NET any -> 1.94.234.157 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102580; rev:2;)
alert tcp $HOME_NET any -> 5.79.70.5 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101134; rev:2;)
alert tcp $HOME_NET any -> 5.161.188.204 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103291; rev:2;)
alert tcp $HOME_NET any -> 5.181.77.115 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103290; rev:2;)
alert tcp $HOME_NET any -> 8.129.227.22 10008 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100925; rev:2;)
alert tcp $HOME_NET any -> 8.130.29.94 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105546; rev:2;)
alert tcp $HOME_NET any -> 8.130.190.133 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103289; rev:2;)
alert tcp $HOME_NET any -> 8.130.210.211 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105626; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103288; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103287; rev:2;)
alert tcp $HOME_NET any -> 8.130.215.115 28082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103286; rev:2;)
alert tcp $HOME_NET any -> 8.134.51.218 8098 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103659; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8111 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103284; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8112 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103283; rev:2;)
alert tcp $HOME_NET any -> 8.134.70.73 8113 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103282; rev:2;)
alert tcp $HOME_NET any -> 8.134.132.22 5022 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106420; rev:2;)
alert tcp $HOME_NET any -> 8.134.166.14 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104482; rev:2;)
alert tcp $HOME_NET any -> 8.134.194.129 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103281; rev:2;)
alert tcp $HOME_NET any -> 8.134.255.60 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103280; rev:2;)
alert tcp $HOME_NET any -> 8.134.255.60 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103279; rev:2;)
alert tcp $HOME_NET any -> 8.135.18.143 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101198; rev:2;)
alert tcp $HOME_NET any -> 8.135.47.140 31001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103278; rev:2;)
alert tcp $HOME_NET any -> 8.135.47.140 31002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103277; rev:2;)
alert tcp $HOME_NET any -> 8.137.22.68 12345 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103276; rev:2;)
alert tcp $HOME_NET any -> 8.137.78.158 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104443; rev:2;)
alert tcp $HOME_NET any -> 8.138.0.204 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103275; rev:2;)
alert tcp $HOME_NET any -> 8.138.30.206 8011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103653; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106419; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106820; rev:2;)
alert tcp $HOME_NET any -> 8.138.143.229 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106342; rev:2;)
alert tcp $HOME_NET any -> 8.138.251.8 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106474; rev:2;)
alert tcp $HOME_NET any -> 8.140.209.1 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103274; rev:2;)
alert tcp $HOME_NET any -> 8.140.232.67 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103273; rev:2;)
alert tcp $HOME_NET any -> 8.140.236.137 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103272; rev:2;)
alert tcp $HOME_NET any -> 8.141.88.204 38084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103271; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 89 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103270; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 7876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103269; rev:2;)
alert tcp $HOME_NET any -> 8.141.99.41 8076 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104481; rev:2;)
alert tcp $HOME_NET any -> 8.145.34.111 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103268; rev:2;)
alert tcp $HOME_NET any -> 8.145.52.37 5222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103267; rev:2;)
alert tcp $HOME_NET any -> 8.145.59.5 11112 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100924; rev:2;)
alert tcp $HOME_NET any -> 8.145.62.66 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103266; rev:2;)
alert tcp $HOME_NET any -> 8.145.62.66 10010 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103265; rev:2;)
alert tcp $HOME_NET any -> 8.147.56.196 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103264; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100997; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100995; rev:2;)
alert tcp $HOME_NET any -> 8.148.13.91 9000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103891; rev:2;)
alert tcp $HOME_NET any -> 8.148.71.22 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103263; rev:2;)
alert tcp $HOME_NET any -> 8.148.179.247 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106341; rev:2;)
alert tcp $HOME_NET any -> 8.148.181.158 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103262; rev:2;)
alert tcp $HOME_NET any -> 8.148.184.109 6000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103261; rev:2;)
alert tcp $HOME_NET any -> 8.148.184.136 8228 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103260; rev:2;)
alert tcp $HOME_NET any -> 8.148.201.210 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104023; rev:2;)
alert tcp $HOME_NET any -> 8.149.139.253 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103259; rev:2;)
alert tcp $HOME_NET any -> 8.152.201.69 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103258; rev:2;)
alert tcp $HOME_NET any -> 8.152.214.50 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103256; rev:2;)
alert tcp $HOME_NET any -> 8.152.218.153 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100923; rev:2;)
alert tcp $HOME_NET any -> 8.155.11.100 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103255; rev:2;)
alert tcp $HOME_NET any -> 8.156.39.163 53 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103254; rev:2;)
alert tcp $HOME_NET any -> 8.156.77.10 65323 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103253; rev:2;)
alert tcp $HOME_NET any -> 8.156.77.10 65334 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104480; rev:2;)
alert tcp $HOME_NET any -> 8.156.84.216 8811 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100922; rev:2;)
alert tcp $HOME_NET any -> 8.160.179.57 18000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103252; rev:2;)
alert tcp $HOME_NET any -> 8.160.179.135 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103946; rev:2;)
alert tcp $HOME_NET any -> 8.160.189.25 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104168; rev:2;)
alert tcp $HOME_NET any -> 8.160.189.25 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103900; rev:2;)
alert tcp $HOME_NET any -> 8.163.44.52 23456 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103251; rev:2;)
alert tcp $HOME_NET any -> 8.163.59.20 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106810; rev:2;)
alert tcp $HOME_NET any -> 8.210.131.228 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103250; rev:2;)
alert tcp $HOME_NET any -> 8.210.222.251 56789 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103622; rev:2;)
alert tcp $HOME_NET any -> 8.210.248.241 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104479; rev:2;)
alert tcp $HOME_NET any -> 8.210.253.7 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105632; rev:2;)
alert tcp $HOME_NET any -> 8.211.146.92 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100998; rev:2;)
alert tcp $HOME_NET any -> 8.211.194.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104478; rev:2;)
alert tcp $HOME_NET any -> 8.213.149.0 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106614; rev:2;)
alert tcp $HOME_NET any -> 8.216.20.25 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104442; rev:2;)
alert tcp $HOME_NET any -> 8.217.34.108 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104832; rev:2;)
alert tcp $HOME_NET any -> 8.218.4.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103249; rev:2;)
alert tcp $HOME_NET any -> 8.218.4.6 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105854; rev:2;)
alert tcp $HOME_NET any -> 8.218.82.170 18090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103248; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103247; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103246; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 5900 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103245; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103244; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 35000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103243; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 39000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103242; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 45000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103241; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 53000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103240; rev:2;)
alert tcp $HOME_NET any -> 8.218.114.253 59000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103239; rev:2;)
alert tcp $HOME_NET any -> 8.218.138.77 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103238; rev:2;)
alert tcp $HOME_NET any -> 8.219.90.249 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103237; rev:2;)
alert tcp $HOME_NET any -> 8.219.90.249 8848 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103236; rev:2;)
alert tcp $HOME_NET any -> 8.219.154.237 44321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105094; rev:2;)
alert tcp $HOME_NET any -> 8.219.208.193 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103235; rev:2;)
alert tcp $HOME_NET any -> 8.219.208.193 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103234; rev:2;)
alert tcp $HOME_NET any -> 8.219.211.139 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105629; rev:2;)
alert tcp $HOME_NET any -> 8.219.211.139 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105662; rev:2;)
alert tcp $HOME_NET any -> 8.220.246.195 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104477; rev:2;)
alert tcp $HOME_NET any -> 13.204.0.27 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102579; rev:2;)
alert tcp $HOME_NET any -> 13.210.13.81 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102578; rev:2;)
alert tcp $HOME_NET any -> 13.212.111.223 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102577; rev:2;)
alert tcp $HOME_NET any -> 13.212.206.34 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102576; rev:2;)
alert tcp $HOME_NET any -> 13.231.27.88 56767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102575; rev:2;)
alert tcp $HOME_NET any -> 13.236.190.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102574; rev:2;)
alert tcp $HOME_NET any -> 16.162.195.211 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103233; rev:2;)
alert tcp $HOME_NET any -> 18.139.85.136 2086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103899; rev:2;)
alert tcp $HOME_NET any -> 18.139.222.223 81 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103624; rev:2;)
alert tcp $HOME_NET any -> 18.139.222.223 82 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104441; rev:2;)
alert tcp $HOME_NET any -> 18.162.147.217 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103654; rev:2;)
alert tcp $HOME_NET any -> 18.163.8.203 31522 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103232; rev:2;)
alert tcp $HOME_NET any -> 18.163.8.203 31772 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104476; rev:2;)
alert tcp $HOME_NET any -> 18.178.31.87 65514 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103231; rev:2;)
alert tcp $HOME_NET any -> 18.179.119.184 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103230; rev:2;)
alert tcp $HOME_NET any -> 20.189.122.18 44446 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103229; rev:2;)
alert tcp $HOME_NET any -> 23.27.47.158 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100996; rev:2;)
alert tcp $HOME_NET any -> 23.27.51.31 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103228; rev:2;)
alert tcp $HOME_NET any -> 23.94.23.151 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103227; rev:2;)
alert tcp $HOME_NET any -> 23.94.68.155 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104057; rev:2;)
alert tcp $HOME_NET any -> 23.94.70.197 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103226; rev:2;)
alert tcp $HOME_NET any -> 23.94.70.197 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103225; rev:2;)
alert tcp $HOME_NET any -> 23.94.218.120 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105610; rev:2;)
alert tcp $HOME_NET any -> 23.94.218.120 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105645; rev:2;)
alert tcp $HOME_NET any -> 23.95.14.48 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105865; rev:2;)
alert tcp $HOME_NET any -> 23.95.48.221 81 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103224; rev:2;)
alert tcp $HOME_NET any -> 23.95.48.221 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103223; rev:2;)
alert tcp $HOME_NET any -> 23.95.193.221 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104162; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103222; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 1080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103221; rev:2;)
alert tcp $HOME_NET any -> 23.95.242.55 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103220; rev:2;)
alert tcp $HOME_NET any -> 23.95.243.47 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100994; rev:2;)
alert tcp $HOME_NET any -> 23.148.212.219 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103219; rev:2;)
alert tcp $HOME_NET any -> 23.148.212.219 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103218; rev:2;)
alert tcp $HOME_NET any -> 23.224.69.106 3308 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103217; rev:2;)
alert tcp $HOME_NET any -> 23.224.69.107 3308 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103216; rev:2;)
alert tcp $HOME_NET any -> 23.224.69.108 3308 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103215; rev:2;)
alert tcp $HOME_NET any -> 23.224.69.109 3308 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103214; rev:2;)
alert tcp $HOME_NET any -> 23.224.69.110 3308 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103213; rev:2;)
alert tcp $HOME_NET any -> 23.225.71.207 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103212; rev:2;)
alert tcp $HOME_NET any -> 23.238.28.180 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103211; rev:2;)
alert tcp $HOME_NET any -> 23.238.28.180 58443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104022; rev:2;)
alert tcp $HOME_NET any -> 23.252.123.26 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103210; rev:2;)
alert tcp $HOME_NET any -> 23.254.174.175 8005 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103209; rev:2;)
alert tcp $HOME_NET any -> 23.254.208.236 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103208; rev:2;)
alert tcp $HOME_NET any -> 23.254.208.236 9895 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103207; rev:2;)
alert tcp $HOME_NET any -> 23.254.219.25 8011 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103206; rev:2;)
alert tcp $HOME_NET any -> 23.254.219.25 61617 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103814; rev:2;)
alert tcp $HOME_NET any -> 23.254.242.24 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104216; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.3 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103205; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.3 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101018; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.6 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103204; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.6 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101019; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.7 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103203; rev:2;)
alert tcp $HOME_NET any -> 27.124.18.7 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101017; rev:2;)
alert tcp $HOME_NET any -> 31.7.62.178 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103202; rev:2;)
alert tcp $HOME_NET any -> 31.7.62.178 12581 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103201; rev:2;)
alert tcp $HOME_NET any -> 31.7.62.178 12583 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103200; rev:2;)
alert tcp $HOME_NET any -> 34.92.225.25 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100993; rev:2;)
alert tcp $HOME_NET any -> 34.243.36.28 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103199; rev:2;)
alert tcp $HOME_NET any -> 36.133.235.214 18088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106797; rev:2;)
alert tcp $HOME_NET any -> 36.133.235.214 18089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103198; rev:2;)
alert tcp $HOME_NET any -> 36.150.231.14 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103197; rev:2;)
alert tcp $HOME_NET any -> 36.151.147.23 8877 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105864; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.98 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103196; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.99 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103195; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.100 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103194; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.101 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103193; rev:2;)
alert tcp $HOME_NET any -> 38.45.125.102 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103192; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.202 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105093; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.203 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105092; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.204 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103191; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.205 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105091; rev:2;)
alert tcp $HOME_NET any -> 38.46.15.206 4141 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105090; rev:2;)
alert tcp $HOME_NET any -> 38.47.102.194 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100992; rev:2;)
alert tcp $HOME_NET any -> 38.47.122.87 5432 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106081; rev:2;)
alert tcp $HOME_NET any -> 38.47.213.14 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103190; rev:2;)
alert tcp $HOME_NET any -> 38.47.221.12 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103189; rev:2;)
alert tcp $HOME_NET any -> 38.54.1.21 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103188; rev:2;)
alert tcp $HOME_NET any -> 38.54.13.44 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103187; rev:2;)
alert tcp $HOME_NET any -> 38.54.14.80 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104097; rev:2;)
alert tcp $HOME_NET any -> 38.54.40.184 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103186; rev:2;)
alert tcp $HOME_NET any -> 38.54.63.84 9988 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103185; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.51 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103184; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.51 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103183; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.136 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103182; rev:2;)
alert tcp $HOME_NET any -> 38.55.107.19 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103181; rev:2;)
alert tcp $HOME_NET any -> 38.55.194.135 9980 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101016; rev:2;)
alert tcp $HOME_NET any -> 38.55.199.2 93 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106796; rev:2;)
alert tcp $HOME_NET any -> 38.55.199.242 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104181; rev:2;)
alert tcp $HOME_NET any -> 38.55.200.183 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104475; rev:2;)
alert tcp $HOME_NET any -> 38.55.200.183 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101338; rev:2;)
alert tcp $HOME_NET any -> 38.60.125.131 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103180; rev:2;)
alert tcp $HOME_NET any -> 38.60.125.131 888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103179; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103178; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 1443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103177; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 4443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103176; rev:2;)
alert tcp $HOME_NET any -> 38.60.242.230 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103175; rev:2;)
alert tcp $HOME_NET any -> 38.60.242.230 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103174; rev:2;)
alert tcp $HOME_NET any -> 38.60.245.181 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105661; rev:2;)
alert tcp $HOME_NET any -> 38.60.245.181 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105665; rev:2;)
alert tcp $HOME_NET any -> 38.76.169.233 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103173; rev:2;)
alert tcp $HOME_NET any -> 38.76.201.200 33333 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103172; rev:2;)
alert tcp $HOME_NET any -> 38.76.202.152 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104021; rev:2;)
alert tcp $HOME_NET any -> 38.147.164.81 13389 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103171; rev:2;)
alert tcp $HOME_NET any -> 38.147.170.102 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103170; rev:2;)
alert tcp $HOME_NET any -> 38.181.44.109 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103169; rev:2;)
alert tcp $HOME_NET any -> 38.181.44.109 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103168; rev:2;)
alert tcp $HOME_NET any -> 38.181.44.109 9999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103167; rev:2;)
alert tcp $HOME_NET any -> 38.190.198.30 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103166; rev:2;)
alert tcp $HOME_NET any -> 38.207.161.212 7410 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103165; rev:2;)
alert tcp $HOME_NET any -> 38.207.174.50 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101661; rev:2;)
alert tcp $HOME_NET any -> 38.207.178.19 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105340; rev:2;)
alert tcp $HOME_NET any -> 38.207.178.223 50001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101015; rev:2;)
alert tcp $HOME_NET any -> 39.96.15.121 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103164; rev:2;)
alert tcp $HOME_NET any -> 39.96.59.24 21001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103163; rev:2;)
alert tcp $HOME_NET any -> 39.96.76.250 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103675; rev:2;)
alert tcp $HOME_NET any -> 39.96.78.213 7443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103162; rev:2;)
alert tcp $HOME_NET any -> 39.96.210.196 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103161; rev:2;)
alert tcp $HOME_NET any -> 39.97.43.242 1988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104474; rev:2;)
alert tcp $HOME_NET any -> 39.97.234.171 10443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101014; rev:2;)
alert tcp $HOME_NET any -> 39.98.80.107 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106418; rev:2;)
alert tcp $HOME_NET any -> 39.98.80.107 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106613; rev:2;)
alert tcp $HOME_NET any -> 39.98.84.209 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103160; rev:2;)
alert tcp $HOME_NET any -> 39.98.116.82 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103159; rev:2;)
alert tcp $HOME_NET any -> 39.99.41.108 1236 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103158; rev:2;)
alert tcp $HOME_NET any -> 39.101.78.48 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103155; rev:2;)
alert tcp $HOME_NET any -> 39.102.57.23 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103947; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 30064 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103157; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38541 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103156; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38542 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103154; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38543 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103153; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38544 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103152; rev:2;)
alert tcp $HOME_NET any -> 39.104.25.196 38664 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103151; rev:2;)
alert tcp $HOME_NET any -> 39.104.48.247 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103150; rev:2;)
alert tcp $HOME_NET any -> 39.105.201.242 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103149; rev:2;)
alert tcp $HOME_NET any -> 39.105.201.242 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103148; rev:2;)
alert tcp $HOME_NET any -> 39.105.211.235 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103147; rev:2;)
alert tcp $HOME_NET any -> 39.105.213.209 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106557; rev:2;)
alert tcp $HOME_NET any -> 39.106.171.189 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106631; rev:2;)
alert tcp $HOME_NET any -> 39.106.171.189 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103146; rev:2;)
alert tcp $HOME_NET any -> 39.106.181.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106612; rev:2;)
alert tcp $HOME_NET any -> 39.107.71.36 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101013; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103145; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 9995 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103144; rev:2;)
alert tcp $HOME_NET any -> 39.107.110.12 15645 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103143; rev:2;)
alert tcp $HOME_NET any -> 39.107.139.26 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100990; rev:2;)
alert tcp $HOME_NET any -> 39.109.126.185 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100991; rev:2;)
alert tcp $HOME_NET any -> 39.109.126.185 12306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101204; rev:2;)
alert tcp $HOME_NET any -> 42.51.32.56 44441 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103142; rev:2;)
alert tcp $HOME_NET any -> 42.51.32.56 44444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101011; rev:2;)
alert tcp $HOME_NET any -> 42.51.32.56 44445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103141; rev:2;)
alert tcp $HOME_NET any -> 42.51.32.56 44446 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103140; rev:2;)
alert tcp $HOME_NET any -> 42.51.45.122 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103139; rev:2;)
alert tcp $HOME_NET any -> 42.51.45.122 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103138; rev:2;)
alert tcp $HOME_NET any -> 42.194.203.58 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103137; rev:2;)
alert tcp $HOME_NET any -> 43.106.28.184 44321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105089; rev:2;)
alert tcp $HOME_NET any -> 43.110.42.102 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103136; rev:2;)
alert tcp $HOME_NET any -> 43.110.42.102 81 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103135; rev:2;)
alert tcp $HOME_NET any -> 43.110.54.62 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103645; rev:2;)
alert tcp $HOME_NET any -> 43.111.235.219 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103134; rev:2;)
alert tcp $HOME_NET any -> 43.111.235.219 16667 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103133; rev:2;)
alert tcp $HOME_NET any -> 43.128.130.45 56502 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103132; rev:2;)
alert tcp $HOME_NET any -> 43.130.69.135 18083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103131; rev:2;)
alert tcp $HOME_NET any -> 43.134.100.72 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101012; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103129; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 34675 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103128; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 35675 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103127; rev:2;)
alert tcp $HOME_NET any -> 43.136.40.48 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103126; rev:2;)
alert tcp $HOME_NET any -> 43.136.76.42 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100989; rev:2;)
alert tcp $HOME_NET any -> 43.136.76.42 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101203; rev:2;)
alert tcp $HOME_NET any -> 43.136.93.81 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105335; rev:2;)
alert tcp $HOME_NET any -> 43.136.180.65 9080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101009; rev:2;)
alert tcp $HOME_NET any -> 43.137.40.36 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103125; rev:2;)
alert tcp $HOME_NET any -> 43.138.167.38 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100988; rev:2;)
alert tcp $HOME_NET any -> 43.138.188.218 32003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103124; rev:2;)
alert tcp $HOME_NET any -> 43.138.210.138 44333 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103944; rev:2;)
alert tcp $HOME_NET any -> 43.139.29.63 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103123; rev:2;)
alert tcp $HOME_NET any -> 43.139.108.161 40010 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104473; rev:2;)
alert tcp $HOME_NET any -> 43.139.174.4 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103122; rev:2;)
alert tcp $HOME_NET any -> 43.139.191.248 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103121; rev:2;)
alert tcp $HOME_NET any -> 43.139.191.248 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103120; rev:2;)
alert tcp $HOME_NET any -> 43.139.208.225 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103119; rev:2;)
alert tcp $HOME_NET any -> 43.139.225.234 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103118; rev:2;)
alert tcp $HOME_NET any -> 43.142.51.69 8001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103117; rev:2;)
alert tcp $HOME_NET any -> 43.142.149.191 6002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105862; rev:2;)
alert tcp $HOME_NET any -> 43.143.13.146 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100977; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100980; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100975; rev:2;)
alert tcp $HOME_NET any -> 43.143.14.43 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100984; rev:2;)
alert tcp $HOME_NET any -> 43.143.34.190 4444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103116; rev:2;)
alert tcp $HOME_NET any -> 43.143.34.190 12345 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103115; rev:2;)
alert tcp $HOME_NET any -> 43.143.148.215 8011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103114; rev:2;)
alert tcp $HOME_NET any -> 43.143.206.225 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103113; rev:2;)
alert tcp $HOME_NET any -> 43.143.206.225 3307 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101010; rev:2;)
alert tcp $HOME_NET any -> 43.143.210.122 3388 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103112; rev:2;)
alert tcp $HOME_NET any -> 43.143.214.85 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103111; rev:2;)
alert tcp $HOME_NET any -> 43.143.214.85 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103110; rev:2;)
alert tcp $HOME_NET any -> 43.154.86.87 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103109; rev:2;)
alert tcp $HOME_NET any -> 43.154.134.124 9999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103108; rev:2;)
alert tcp $HOME_NET any -> 43.156.82.119 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103107; rev:2;)
alert tcp $HOME_NET any -> 43.156.82.119 32211 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103106; rev:2;)
alert tcp $HOME_NET any -> 43.156.179.8 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103105; rev:2;)
alert tcp $HOME_NET any -> 43.165.168.164 4455 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103104; rev:2;)
alert tcp $HOME_NET any -> 43.173.70.252 4455 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103103; rev:2;)
alert tcp $HOME_NET any -> 43.245.199.155 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103102; rev:2;)
alert tcp $HOME_NET any -> 43.246.210.160 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106795; rev:2;)
alert tcp $HOME_NET any -> 43.247.135.106 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103101; rev:2;)
alert tcp $HOME_NET any -> 43.247.135.106 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103100; rev:2;)
alert tcp $HOME_NET any -> 43.247.135.185 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104167; rev:2;)
alert tcp $HOME_NET any -> 43.247.135.185 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104166; rev:2;)
alert tcp $HOME_NET any -> 43.254.166.35 39001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101648; rev:2;)
alert tcp $HOME_NET any -> 43.255.156.232 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103099; rev:2;)
alert tcp $HOME_NET any -> 43.255.156.232 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103098; rev:2;)
alert tcp $HOME_NET any -> 43.255.156.232 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103097; rev:2;)
alert tcp $HOME_NET any -> 45.63.120.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105615; rev:2;)
alert tcp $HOME_NET any -> 45.63.120.124 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105624; rev:2;)
alert tcp $HOME_NET any -> 45.76.99.126 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103096; rev:2;)
alert tcp $HOME_NET any -> 45.76.99.126 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103095; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105613; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 6667 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105660; rev:2;)
alert tcp $HOME_NET any -> 45.76.145.171 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105623; rev:2;)
alert tcp $HOME_NET any -> 45.76.146.82 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104472; rev:2;)
alert tcp $HOME_NET any -> 45.76.146.82 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104831; rev:2;)
alert tcp $HOME_NET any -> 45.76.185.115 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103094; rev:2;)
alert tcp $HOME_NET any -> 45.77.26.165 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103093; rev:2;)
alert tcp $HOME_NET any -> 45.77.26.165 33454 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103092; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105675; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105617; rev:2;)
alert tcp $HOME_NET any -> 45.77.28.40 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105638; rev:2;)
alert tcp $HOME_NET any -> 45.77.38.40 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105673; rev:2;)
alert tcp $HOME_NET any -> 45.77.220.145 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103091; rev:2;)
alert tcp $HOME_NET any -> 45.77.220.145 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103090; rev:2;)
alert tcp $HOME_NET any -> 45.77.240.46 39756 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105334; rev:2;)
alert tcp $HOME_NET any -> 45.77.242.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103089; rev:2;)
alert tcp $HOME_NET any -> 45.86.229.111 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100986; rev:2;)
alert tcp $HOME_NET any -> 45.86.229.111 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100987; rev:2;)
alert tcp $HOME_NET any -> 45.87.53.6 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103088; rev:2;)
alert tcp $HOME_NET any -> 45.90.58.202 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103087; rev:2;)
alert tcp $HOME_NET any -> 45.115.124.42 1433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103086; rev:2;)
alert tcp $HOME_NET any -> 45.115.124.42 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103085; rev:2;)
alert tcp $HOME_NET any -> 45.115.124.44 1433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103084; rev:2;)
alert tcp $HOME_NET any -> 45.115.124.44 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103083; rev:2;)
alert tcp $HOME_NET any -> 45.130.147.57 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104440; rev:2;)
alert tcp $HOME_NET any -> 45.130.147.57 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103082; rev:2;)
alert tcp $HOME_NET any -> 45.135.118.214 2086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103081; rev:2;)
alert tcp $HOME_NET any -> 45.135.118.214 8880 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103080; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103079; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103078; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103077; rev:2;)
alert tcp $HOME_NET any -> 45.142.127.204 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103076; rev:2;)
alert tcp $HOME_NET any -> 45.150.64.117 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103075; rev:2;)
alert tcp $HOME_NET any -> 45.192.103.138 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106340; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.32 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106794; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.11 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103074; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.11 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103073; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.15 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103072; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.15 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103071; rev:2;)
alert tcp $HOME_NET any -> 45.192.242.132 9178 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105861; rev:2;)
alert tcp $HOME_NET any -> 45.194.17.183 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100983; rev:2;)
alert tcp $HOME_NET any -> 45.194.17.183 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100982; rev:2;)
alert tcp $HOME_NET any -> 45.194.21.64 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103070; rev:2;)
alert tcp $HOME_NET any -> 45.194.21.64 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103069; rev:2;)
alert tcp $HOME_NET any -> 45.197.36.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103068; rev:2;)
alert tcp $HOME_NET any -> 45.197.36.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103067; rev:2;)
alert tcp $HOME_NET any -> 45.205.27.227 9997 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103066; rev:2;)
alert tcp $HOME_NET any -> 45.205.27.227 9998 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103065; rev:2;)
alert tcp $HOME_NET any -> 45.205.27.227 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103064; rev:2;)
alert tcp $HOME_NET any -> 45.207.35.31 8087 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105860; rev:2;)
alert tcp $HOME_NET any -> 45.207.194.79 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103063; rev:2;)
alert tcp $HOME_NET any -> 45.207.215.191 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103813; rev:2;)
alert tcp $HOME_NET any -> 45.221.112.127 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106836; rev:2;)
alert tcp $HOME_NET any -> 45.221.112.127 4443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106835; rev:2;)
alert tcp $HOME_NET any -> 45.221.115.76 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103062; rev:2;)
alert tcp $HOME_NET any -> 45.221.115.76 8843 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103898; rev:2;)
alert tcp $HOME_NET any -> 45.221.115.160 1433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103061; rev:2;)
alert tcp $HOME_NET any -> 45.221.118.139 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101577; rev:2;)
alert tcp $HOME_NET any -> 46.28.69.174 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103060; rev:2;)
alert tcp $HOME_NET any -> 46.28.69.174 444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103059; rev:2;)
alert tcp $HOME_NET any -> 46.28.69.174 5433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103058; rev:2;)
alert tcp $HOME_NET any -> 46.28.69.174 6380 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103057; rev:2;)
alert tcp $HOME_NET any -> 47.74.43.122 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103812; rev:2;)
alert tcp $HOME_NET any -> 47.76.37.50 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103056; rev:2;)
alert tcp $HOME_NET any -> 47.76.245.121 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103055; rev:2;)
alert tcp $HOME_NET any -> 47.76.252.195 10033 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105539; rev:2;)
alert tcp $HOME_NET any -> 47.79.123.84 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103054; rev:2;)
alert tcp $HOME_NET any -> 47.79.123.84 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103053; rev:2;)
alert tcp $HOME_NET any -> 47.80.57.141 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103052; rev:2;)
alert tcp $HOME_NET any -> 47.80.57.141 8889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103051; rev:2;)
alert tcp $HOME_NET any -> 47.86.14.173 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103050; rev:2;)
alert tcp $HOME_NET any -> 47.86.82.95 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103049; rev:2;)
alert tcp $HOME_NET any -> 47.86.171.139 6789 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106339; rev:2;)
alert tcp $HOME_NET any -> 47.90.209.157 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106064; rev:2;)
alert tcp $HOME_NET any -> 47.92.166.186 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103048; rev:2;)
alert tcp $HOME_NET any -> 47.92.173.209 8045 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103047; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103046; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103045; rev:2;)
alert tcp $HOME_NET any -> 47.92.243.178 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103044; rev:2;)
alert tcp $HOME_NET any -> 47.93.9.48 60001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103043; rev:2;)
alert tcp $HOME_NET any -> 47.93.9.48 60006 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103042; rev:2;)
alert tcp $HOME_NET any -> 47.93.90.107 59623 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104471; rev:2;)
alert tcp $HOME_NET any -> 47.93.159.68 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100985; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50009 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103041; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50010 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104439; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103040; rev:2;)
alert tcp $HOME_NET any -> 47.93.184.204 50015 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103039; rev:2;)
alert tcp $HOME_NET any -> 47.93.198.64 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103038; rev:2;)
alert tcp $HOME_NET any -> 47.93.236.243 30001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103037; rev:2;)
alert tcp $HOME_NET any -> 47.94.108.209 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105627; rev:2;)
alert tcp $HOME_NET any -> 47.94.178.217 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103811; rev:2;)
alert tcp $HOME_NET any -> 47.94.194.175 15000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101008; rev:2;)
alert tcp $HOME_NET any -> 47.95.159.107 9004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103036; rev:2;)
alert tcp $HOME_NET any -> 47.95.192.147 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103452; rev:2;)
alert tcp $HOME_NET any -> 47.96.87.75 1883 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106611; rev:2;)
alert tcp $HOME_NET any -> 47.96.143.115 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103035; rev:2;)
alert tcp $HOME_NET any -> 47.96.176.28 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104438; rev:2;)
alert tcp $HOME_NET any -> 47.96.236.191 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105333; rev:2;)
alert tcp $HOME_NET any -> 47.97.0.198 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100979; rev:2;)
alert tcp $HOME_NET any -> 47.97.0.198 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100972; rev:2;)
alert tcp $HOME_NET any -> 47.97.8.45 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106792; rev:2;)
alert tcp $HOME_NET any -> 47.97.47.29 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103034; rev:2;)
alert tcp $HOME_NET any -> 47.97.180.244 8444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104020; rev:2;)
alert tcp $HOME_NET any -> 47.97.199.23 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104470; rev:2;)
alert tcp $HOME_NET any -> 47.98.56.18 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103033; rev:2;)
alert tcp $HOME_NET any -> 47.98.102.101 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103032; rev:2;)
alert tcp $HOME_NET any -> 47.98.121.92 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104437; rev:2;)
alert tcp $HOME_NET any -> 47.98.172.208 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103031; rev:2;)
alert tcp $HOME_NET any -> 47.98.180.229 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103030; rev:2;)
alert tcp $HOME_NET any -> 47.98.244.8 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106793; rev:2;)
alert tcp $HOME_NET any -> 47.98.245.24 7000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104019; rev:2;)
alert tcp $HOME_NET any -> 47.100.34.234 808 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103029; rev:2;)
alert tcp $HOME_NET any -> 47.100.80.108 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103028; rev:2;)
alert tcp $HOME_NET any -> 47.100.160.178 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104469; rev:2;)
alert tcp $HOME_NET any -> 47.100.187.115 19999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103027; rev:2;)
alert tcp $HOME_NET any -> 47.101.172.178 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103026; rev:2;)
alert tcp $HOME_NET any -> 47.102.118.214 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100981; rev:2;)
alert tcp $HOME_NET any -> 47.103.214.7 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103025; rev:2;)
alert tcp $HOME_NET any -> 47.104.246.255 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103618; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 3336 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103024; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103023; rev:2;)
alert tcp $HOME_NET any -> 47.105.100.60 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103022; rev:2;)
alert tcp $HOME_NET any -> 47.105.114.163 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104468; rev:2;)
alert tcp $HOME_NET any -> 47.108.65.230 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103021; rev:2;)
alert tcp $HOME_NET any -> 47.109.46.246 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103604; rev:2;)
alert tcp $HOME_NET any -> 47.109.197.162 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106338; rev:2;)
alert tcp $HOME_NET any -> 47.110.72.155 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105858; rev:2;)
alert tcp $HOME_NET any -> 47.111.171.130 8077 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101007; rev:2;)
alert tcp $HOME_NET any -> 47.111.230.105 5000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106337; rev:2;)
alert tcp $HOME_NET any -> 47.112.124.150 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103020; rev:2;)
alert tcp $HOME_NET any -> 47.113.179.196 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101337; rev:2;)
alert tcp $HOME_NET any -> 47.113.179.196 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105088; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103019; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103018; rev:2;)
alert tcp $HOME_NET any -> 47.115.34.48 1082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101576; rev:2;)
alert tcp $HOME_NET any -> 47.115.200.146 5003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103017; rev:2;)
alert tcp $HOME_NET any -> 47.115.207.5 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103016; rev:2;)
alert tcp $HOME_NET any -> 47.116.103.142 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103015; rev:2;)
alert tcp $HOME_NET any -> 47.116.111.156 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103014; rev:2;)
alert tcp $HOME_NET any -> 47.116.115.7 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103013; rev:2;)
alert tcp $HOME_NET any -> 47.116.217.241 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103012; rev:2;)
alert tcp $HOME_NET any -> 47.119.145.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103011; rev:2;)
alert tcp $HOME_NET any -> 47.120.46.170 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103890; rev:2;)
alert tcp $HOME_NET any -> 47.121.31.109 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103010; rev:2;)
alert tcp $HOME_NET any -> 47.122.114.156 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104436; rev:2;)
alert tcp $HOME_NET any -> 47.122.120.188 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103810; rev:2;)
alert tcp $HOME_NET any -> 47.129.3.232 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103009; rev:2;)
alert tcp $HOME_NET any -> 47.129.155.127 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103008; rev:2;)
alert tcp $HOME_NET any -> 47.129.155.127 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103007; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 2095 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103006; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101440; rev:2;)
alert tcp $HOME_NET any -> 47.236.130.154 58357 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103005; rev:2;)
alert tcp $HOME_NET any -> 47.236.197.86 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100976; rev:2;)
alert tcp $HOME_NET any -> 47.236.204.56 3695 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103004; rev:2;)
alert tcp $HOME_NET any -> 47.237.68.187 40801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103003; rev:2;)
alert tcp $HOME_NET any -> 47.237.156.196 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100974; rev:2;)
alert tcp $HOME_NET any -> 47.238.6.14 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105631; rev:2;)
alert tcp $HOME_NET any -> 47.238.7.198 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103002; rev:2;)
alert tcp $HOME_NET any -> 47.239.223.39 5678 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103001; rev:2;)
alert tcp $HOME_NET any -> 47.239.223.39 8123 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103000; rev:2;)
alert tcp $HOME_NET any -> 47.243.177.251 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102999; rev:2;)
alert tcp $HOME_NET any -> 47.243.241.78 60607 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102998; rev:2;)
alert tcp $HOME_NET any -> 47.243.241.78 60609 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102997; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102996; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102995; rev:2;)
alert tcp $HOME_NET any -> 47.250.190.129 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102994; rev:2;)
alert tcp $HOME_NET any -> 47.254.173.184 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100970; rev:2;)
alert tcp $HOME_NET any -> 49.7.54.246 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102993; rev:2;)
alert tcp $HOME_NET any -> 49.51.230.17 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102992; rev:2;)
alert tcp $HOME_NET any -> 49.51.230.17 9898 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102991; rev:2;)
alert tcp $HOME_NET any -> 49.232.105.96 18888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103889; rev:2;)
alert tcp $HOME_NET any -> 49.232.141.174 12345 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104435; rev:2;)
alert tcp $HOME_NET any -> 49.232.166.123 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102989; rev:2;)
alert tcp $HOME_NET any -> 49.232.166.123 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103925; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102988; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102987; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102986; rev:2;)
alert tcp $HOME_NET any -> 49.232.169.67 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102985; rev:2;)
alert tcp $HOME_NET any -> 49.232.183.87 18080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101575; rev:2;)
alert tcp $HOME_NET any -> 49.232.191.108 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102984; rev:2;)
alert tcp $HOME_NET any -> 49.232.230.9 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102983; rev:2;)
alert tcp $HOME_NET any -> 49.233.13.225 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102982; rev:2;)
alert tcp $HOME_NET any -> 49.233.70.168 1883 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102981; rev:2;)
alert tcp $HOME_NET any -> 49.233.70.168 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105537; rev:2;)
alert tcp $HOME_NET any -> 49.233.192.137 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104056; rev:2;)
alert tcp $HOME_NET any -> 49.233.202.218 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100969; rev:2;)
alert tcp $HOME_NET any -> 49.234.12.182 4124 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102980; rev:2;)
alert tcp $HOME_NET any -> 49.234.12.182 4321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102979; rev:2;)
alert tcp $HOME_NET any -> 49.234.28.41 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102978; rev:2;)
alert tcp $HOME_NET any -> 49.234.28.41 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102977; rev:2;)
alert tcp $HOME_NET any -> 49.235.130.208 8523 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105960; rev:2;)
alert tcp $HOME_NET any -> 49.235.130.208 8524 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105959; rev:2;)
alert tcp $HOME_NET any -> 49.235.134.179 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105536; rev:2;)
alert tcp $HOME_NET any -> 49.235.172.25 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102976; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100971; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100973; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 9091 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102975; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102974; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104467; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102973; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102972; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104434; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102971; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102970; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102969; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102968; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102967; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102966; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102965; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102964; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102963; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102962; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102961; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102960; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102959; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104018; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102958; rev:2;)
alert tcp $HOME_NET any -> 54.180.100.54 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102957; rev:2;)
alert tls $HOME_NET any -> 54.183.237.74 443 (msg:"HOLLOWPOINT C2 vshell"; tls.cert_fingerprint; content:"3c9905697b6d709ada162db0bdcc76a7fef047bb2b07758e7e323125ba9b954e"; reference:url,publicmosaic.com/indicators; sid:9100968; rev:2;)
alert tcp $HOME_NET any -> 54.183.237.74 18082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101199; rev:2;)
alert tcp $HOME_NET any -> 58.87.65.43 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102956; rev:2;)
alert tcp $HOME_NET any -> 58.87.99.193 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105855; rev:2;)
alert tcp $HOME_NET any -> 59.110.28.230 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102955; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 53 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102954; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102953; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 5551 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102952; rev:2;)
alert tcp $HOME_NET any -> 60.204.152.14 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102951; rev:2;)
alert tcp $HOME_NET any -> 60.204.240.193 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101006; rev:2;)
alert tcp $HOME_NET any -> 60.205.95.107 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103642; rev:2;)
alert tcp $HOME_NET any -> 60.205.123.176 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102950; rev:2;)
alert tcp $HOME_NET any -> 60.205.164.207 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102949; rev:2;)
alert tcp $HOME_NET any -> 60.205.164.207 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102948; rev:2;)
alert tcp $HOME_NET any -> 60.217.23.146 7086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102947; rev:2;)
alert tcp $HOME_NET any -> 61.110.5.174 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102944; rev:2;)
alert tcp $HOME_NET any -> 61.110.5.174 33061 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102943; rev:2;)
alert tcp $HOME_NET any -> 62.234.17.33 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100967; rev:2;)
alert tcp $HOME_NET any -> 62.234.17.33 13332 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105087; rev:2;)
alert tcp $HOME_NET any -> 62.234.37.129 6767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102942; rev:2;)
alert tcp $HOME_NET any -> 62.234.192.69 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102941; rev:2;)
alert tcp $HOME_NET any -> 64.7.199.177 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102940; rev:2;)
alert tcp $HOME_NET any -> 64.7.199.177 10443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102939; rev:2;)
alert tcp $HOME_NET any -> 64.81.114.71 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102938; rev:2;)
alert tcp $HOME_NET any -> 64.83.33.237 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102937; rev:2;)
alert tcp $HOME_NET any -> 64.111.93.243 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102936; rev:2;)
alert tcp $HOME_NET any -> 64.111.93.243 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102935; rev:2;)
alert tcp $HOME_NET any -> 64.176.84.14 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103979; rev:2;)
alert tcp $HOME_NET any -> 64.176.229.71 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103888; rev:2;)
alert tcp $HOME_NET any -> 65.0.216.226 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102934; rev:2;)
alert tcp $HOME_NET any -> 65.20.91.137 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102933; rev:2;)
alert tcp $HOME_NET any -> 65.20.91.137 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102932; rev:2;)
alert tcp $HOME_NET any -> 65.49.233.42 3306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102931; rev:2;)
alert tcp $HOME_NET any -> 66.42.63.189 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104017; rev:2;)
alert tcp $HOME_NET any -> 66.59.199.82 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102930; rev:2;)
alert tcp $HOME_NET any -> 66.154.119.224 8899 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106610; rev:2;)
alert tcp $HOME_NET any -> 66.179.30.146 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102929; rev:2;)
alert tcp $HOME_NET any -> 66.179.31.191 8099 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106609; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100966; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100964; rev:2;)
alert tcp $HOME_NET any -> 68.183.147.242 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100965; rev:2;)
alert tcp $HOME_NET any -> 69.48.228.156 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102928; rev:2;)
alert tcp $HOME_NET any -> 69.48.229.177 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102927; rev:2;)
alert tcp $HOME_NET any -> 77.73.14.175 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102926; rev:2;)
alert tcp $HOME_NET any -> 77.111.101.84 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106608; rev:2;)
alert tcp $HOME_NET any -> 77.111.101.118 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102925; rev:2;)
alert tcp $HOME_NET any -> 78.13.60.90 14448 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106791; rev:2;)
alert tcp $HOME_NET any -> 78.13.60.90 15000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102924; rev:2;)
alert tcp $HOME_NET any -> 81.70.21.248 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106808; rev:2;)
alert tcp $HOME_NET any -> 81.70.95.138 9096 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105853; rev:2;)
alert tcp $HOME_NET any -> 81.70.95.138 9595 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101005; rev:2;)
alert tcp $HOME_NET any -> 81.70.202.180 8822 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102923; rev:2;)
alert tcp $HOME_NET any -> 81.71.83.109 18082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102922; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.97 8023 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105850; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.123 8023 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105852; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.164 8023 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105851; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.186 8023 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101995; rev:2;)
alert tcp $HOME_NET any -> 82.40.42.193 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102921; rev:2;)
alert tcp $HOME_NET any -> 82.40.42.193 8880 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102920; rev:2;)
alert tcp $HOME_NET any -> 82.156.97.77 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102919; rev:2;)
alert tcp $HOME_NET any -> 82.156.117.56 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102918; rev:2;)
alert tcp $HOME_NET any -> 82.156.243.144 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102917; rev:2;)
alert tcp $HOME_NET any -> 82.157.13.47 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102916; rev:2;)
alert tcp $HOME_NET any -> 82.157.155.59 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106802; rev:2;)
alert tcp $HOME_NET any -> 82.157.174.198 9089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102915; rev:2;)
alert tcp $HOME_NET any -> 82.157.181.81 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102914; rev:2;)
alert tcp $HOME_NET any -> 82.157.181.81 8894 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102913; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.240 23679 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105692; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.240 61144 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105691; rev:2;)
alert tcp $HOME_NET any -> 83.229.126.134 8506 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104680; rev:2;)
alert tcp $HOME_NET any -> 85.121.245.52 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102912; rev:2;)
alert tcp $HOME_NET any -> 85.209.48.248 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102911; rev:2;)
alert tcp $HOME_NET any -> 88.216.191.9 8880 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102910; rev:2;)
alert tcp $HOME_NET any -> 88.216.208.91 2052 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102909; rev:2;)
alert tcp $HOME_NET any -> 88.216.208.91 65512 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102908; rev:2;)
alert tcp $HOME_NET any -> 88.216.208.91 65523 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102907; rev:2;)
alert tcp $HOME_NET any -> 88.218.76.201 8889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102906; rev:2;)
alert tcp $HOME_NET any -> 89.34.227.96 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100963; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 2087 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102905; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102904; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102903; rev:2;)
alert tcp $HOME_NET any -> 91.92.242.3 7171 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102902; rev:2;)
alert tcp $HOME_NET any -> 91.213.186.177 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102901; rev:2;)
alert tcp $HOME_NET any -> 92.204.242.63 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104433; rev:2;)
alert tcp $HOME_NET any -> 93.177.77.228 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102900; rev:2;)
alert tcp $HOME_NET any -> 93.177.77.228 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102899; rev:2;)
alert tcp $HOME_NET any -> 95.182.86.106 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102898; rev:2;)
alert tcp $HOME_NET any -> 96.126.179.88 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103972; rev:2;)
alert tls $HOME_NET any -> 96.126.179.88 443 (msg:"HOLLOWPOINT C2 vshell"; tls.cert_fingerprint; content:"70fdc4501c3c7cc5a2513f5b8402ddeaf9cf0d5c83b4ed692e953b9efc8cbe41"; reference:url,publicmosaic.com/indicators; sid:9103971; rev:2;)
alert tcp $HOME_NET any -> 96.126.179.88 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102897; rev:2;)
alert tcp $HOME_NET any -> 96.126.191.30 6080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101004; rev:2;)
alert tcp $HOME_NET any -> 101.32.34.248 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106336; rev:2;)
alert tcp $HOME_NET any -> 101.32.241.197 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102573; rev:2;)
alert tcp $HOME_NET any -> 101.33.45.136 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102572; rev:2;)
alert tcp $HOME_NET any -> 101.34.60.206 38880 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105947; rev:2;)
alert tcp $HOME_NET any -> 101.34.84.27 54321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102896; rev:2;)
alert tcp $HOME_NET any -> 101.34.218.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100953; rev:2;)
alert tcp $HOME_NET any -> 101.34.218.233 8887 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101194; rev:2;)
alert tcp $HOME_NET any -> 101.34.246.164 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102895; rev:2;)
alert tcp $HOME_NET any -> 101.35.11.34 10443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102571; rev:2;)
alert tcp $HOME_NET any -> 101.35.79.54 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102570; rev:2;)
alert tcp $HOME_NET any -> 101.35.150.143 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102569; rev:2;)
alert tcp $HOME_NET any -> 101.35.161.46 9089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102568; rev:2;)
alert tcp $HOME_NET any -> 101.36.127.214 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103965; rev:2;)
alert tcp $HOME_NET any -> 101.37.171.223 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103973; rev:2;)
alert tcp $HOME_NET any -> 101.42.65.25 34566 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103609; rev:2;)
alert tcp $HOME_NET any -> 101.42.104.134 8767 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105289; rev:2;)
alert tcp $HOME_NET any -> 101.42.108.234 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104679; rev:2;)
alert tcp $HOME_NET any -> 101.42.239.7 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102567; rev:2;)
alert tcp $HOME_NET any -> 101.43.18.99 8100 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102894; rev:2;)
alert tcp $HOME_NET any -> 101.43.22.71 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102566; rev:2;)
alert tcp $HOME_NET any -> 101.43.22.71 9077 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105948; rev:2;)
alert tcp $HOME_NET any -> 101.43.107.222 19001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102893; rev:2;)
alert tcp $HOME_NET any -> 101.43.107.222 21235 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104016; rev:2;)
alert tcp $HOME_NET any -> 101.43.115.8 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102892; rev:2;)
alert tcp $HOME_NET any -> 101.43.118.48 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101632; rev:2;)
alert tcp $HOME_NET any -> 101.43.128.56 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105644; rev:2;)
alert tcp $HOME_NET any -> 101.43.128.56 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105628; rev:2;)
alert tcp $HOME_NET any -> 101.96.224.108 50005 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103623; rev:2;)
alert tcp $HOME_NET any -> 101.132.34.211 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102891; rev:2;)
alert tcp $HOME_NET any -> 101.132.60.152 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102565; rev:2;)
alert tcp $HOME_NET any -> 101.132.120.245 5555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102564; rev:2;)
alert tcp $HOME_NET any -> 101.132.120.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102563; rev:2;)
alert tcp $HOME_NET any -> 101.132.153.5 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102562; rev:2;)
alert tcp $HOME_NET any -> 101.132.153.5 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103870; rev:2;)
alert tcp $HOME_NET any -> 101.133.170.144 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106335; rev:2;)
alert tcp $HOME_NET any -> 101.133.237.185 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102890; rev:2;)
alert tcp $HOME_NET any -> 101.200.34.196 5000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102561; rev:2;)
alert tcp $HOME_NET any -> 101.200.193.211 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100962; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.177 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101345; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.177 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105686; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.177 23113 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105685; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.177 58642 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105684; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.177 63525 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105683; rev:2;)
alert tcp $HOME_NET any -> 102.129.165.178 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104302; rev:2;)
alert tcp $HOME_NET any -> 102.134.54.230 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102560; rev:2;)
alert tcp $HOME_NET any -> 102.134.54.230 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102559; rev:2;)
alert tcp $HOME_NET any -> 102.204.223.106 4444 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101442; rev:2;)
alert tcp $HOME_NET any -> 102.204.223.106 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102558; rev:2;)
alert tcp $HOME_NET any -> 102.204.223.106 47351 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102557; rev:2;)
alert tcp $HOME_NET any -> 102.209.117.153 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102556; rev:2;)
alert tcp $HOME_NET any -> 103.30.76.214 8779 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105945; rev:2;)
alert tcp $HOME_NET any -> 103.42.214.19 15667 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102555; rev:2;)
alert tcp $HOME_NET any -> 103.51.147.252 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102554; rev:2;)
alert tcp $HOME_NET any -> 103.51.147.252 15312 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102553; rev:2;)
alert tcp $HOME_NET any -> 103.73.162.97 14145 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103634; rev:2;)
alert tcp $HOME_NET any -> 103.75.190.47 7788 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102552; rev:2;)
alert tcp $HOME_NET any -> 103.75.190.47 49152 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102551; rev:2;)
alert tcp $HOME_NET any -> 103.77.210.79 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105534; rev:2;)
alert tcp $HOME_NET any -> 103.91.144.194 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102550; rev:2;)
alert tcp $HOME_NET any -> 103.97.177.92 10089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102549; rev:2;)
alert tcp $HOME_NET any -> 103.101.176.234 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103658; rev:2;)
alert tcp $HOME_NET any -> 103.106.230.240 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104209; rev:2;)
alert tcp $HOME_NET any -> 103.110.221.162 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104196; rev:2;)
alert tcp $HOME_NET any -> 103.110.221.162 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104195; rev:2;)
alert tcp $HOME_NET any -> 103.110.221.162 8441 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102548; rev:2;)
alert tcp $HOME_NET any -> 103.113.158.11 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102547; rev:2;)
alert tcp $HOME_NET any -> 103.115.64.31 8808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102546; rev:2;)
alert tcp $HOME_NET any -> 103.115.108.111 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104432; rev:2;)
alert tcp $HOME_NET any -> 103.115.108.111 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106199; rev:2;)
alert tcp $HOME_NET any -> 103.118.247.231 50841 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102545; rev:2;)
alert tcp $HOME_NET any -> 103.123.18.29 32696 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102544; rev:2;)
alert tcp $HOME_NET any -> 103.136.150.98 60334 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102543; rev:2;)
alert tcp $HOME_NET any -> 103.136.150.98 60335 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102542; rev:2;)
alert tcp $HOME_NET any -> 103.136.150.98 60336 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102541; rev:2;)
alert tcp $HOME_NET any -> 103.136.150.98 60337 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102540; rev:2;)
alert tcp $HOME_NET any -> 103.149.93.150 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104597; rev:2;)
alert tcp $HOME_NET any -> 103.153.36.86 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104596; rev:2;)
alert tcp $HOME_NET any -> 103.153.36.86 20000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102539; rev:2;)
alert tcp $HOME_NET any -> 103.153.36.86 20001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102538; rev:2;)
alert tcp $HOME_NET any -> 103.159.206.136 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102537; rev:2;)
alert tcp $HOME_NET any -> 103.159.206.136 10024 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102536; rev:2;)
alert tcp $HOME_NET any -> 103.159.206.136 60024 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102535; rev:2;)
alert tcp $HOME_NET any -> 103.159.206.136 65086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104595; rev:2;)
alert tcp $HOME_NET any -> 103.163.46.183 53 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102889; rev:2;)
alert tcp $HOME_NET any -> 103.163.46.183 50003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102888; rev:2;)
alert tcp $HOME_NET any -> 103.163.47.52 10010 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101003; rev:2;)
alert tcp $HOME_NET any -> 103.163.47.52 10011 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104594; rev:2;)
alert tcp $HOME_NET any -> 103.163.47.202 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106819; rev:2;)
alert tcp $HOME_NET any -> 103.193.172.6 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102534; rev:2;)
alert tcp $HOME_NET any -> 103.197.25.8 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104155; rev:2;)
alert tcp $HOME_NET any -> 103.208.87.59 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104053; rev:2;)
alert tcp $HOME_NET any -> 103.211.32.112 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102533; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105849; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106173; rev:2;)
alert tcp $HOME_NET any -> 103.212.186.12 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106415; rev:2;)
alert tcp $HOME_NET any -> 103.217.187.96 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102887; rev:2;)
alert tcp $HOME_NET any -> 103.229.212.54 5566 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101002; rev:2;)
alert tcp $HOME_NET any -> 103.229.212.54 50003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105946; rev:2;)
alert tcp $HOME_NET any -> 103.230.15.51 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104593; rev:2;)
alert tcp $HOME_NET any -> 103.236.84.103 50828 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102531; rev:2;)
alert tcp $HOME_NET any -> 103.236.87.121 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106607; rev:2;)
alert tcp $HOME_NET any -> 103.236.98.220 49696 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104592; rev:2;)
alert tcp $HOME_NET any -> 103.242.12.143 1234 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101218; rev:2;)
alert tcp $HOME_NET any -> 104.64.210.147 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105611; rev:2;)
alert tcp $HOME_NET any -> 104.143.32.40 12222 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104591; rev:2;)
alert tcp $HOME_NET any -> 104.168.19.222 9000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101191; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102530; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104218; rev:2;)
alert tcp $HOME_NET any -> 104.168.22.209 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104217; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102529; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102528; rev:2;)
alert tcp $HOME_NET any -> 104.168.94.108 38006 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101220; rev:2;)
alert tcp $HOME_NET any -> 104.168.109.192 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102527; rev:2;)
alert tcp $HOME_NET any -> 104.192.80.76 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102526; rev:2;)
alert tcp $HOME_NET any -> 104.194.88.185 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104207; rev:2;)
alert tcp $HOME_NET any -> 104.194.88.185 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104206; rev:2;)
alert tcp $HOME_NET any -> 104.223.59.151 9004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104590; rev:2;)
alert tcp $HOME_NET any -> 104.225.238.193 10010 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106823; rev:2;)
alert tcp $HOME_NET any -> 104.225.238.193 10020 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101219; rev:2;)
alert tcp $HOME_NET any -> 104.233.154.139 888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102524; rev:2;)
alert tcp $HOME_NET any -> 104.234.172.95 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104072; rev:2;)
alert tcp $HOME_NET any -> 104.234.172.217 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104157; rev:2;)
alert tcp $HOME_NET any -> 104.234.172.217 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104156; rev:2;)
alert tcp $HOME_NET any -> 104.244.91.64 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101628; rev:2;)
alert tcp $HOME_NET any -> 106.12.125.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104589; rev:2;)
alert tcp $HOME_NET any -> 106.12.160.30 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104588; rev:2;)
alert tcp $HOME_NET any -> 106.13.74.88 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102523; rev:2;)
alert tcp $HOME_NET any -> 106.13.74.88 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102522; rev:2;)
alert tcp $HOME_NET any -> 106.13.143.83 21 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102886; rev:2;)
alert tcp $HOME_NET any -> 106.13.143.83 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102885; rev:2;)
alert tcp $HOME_NET any -> 106.14.36.132 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102884; rev:2;)
alert tcp $HOME_NET any -> 106.14.36.132 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103868; rev:2;)
alert tcp $HOME_NET any -> 106.14.53.55 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102521; rev:2;)
alert tcp $HOME_NET any -> 106.14.53.55 1333 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102520; rev:2;)
alert tcp $HOME_NET any -> 106.14.58.57 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102519; rev:2;)
alert tcp $HOME_NET any -> 106.14.107.71 44445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103639; rev:2;)
alert tcp $HOME_NET any -> 106.14.155.244 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103869; rev:2;)
alert tcp $HOME_NET any -> 106.14.183.219 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102883; rev:2;)
alert tcp $HOME_NET any -> 106.14.246.141 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104587; rev:2;)
alert tcp $HOME_NET any -> 106.15.44.150 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100960; rev:2;)
alert tcp $HOME_NET any -> 106.15.44.150 8987 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104586; rev:2;)
alert tcp $HOME_NET any -> 106.15.104.224 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102882; rev:2;)
alert tcp $HOME_NET any -> 106.15.104.224 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102881; rev:2;)
alert tcp $HOME_NET any -> 106.15.228.143 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102517; rev:2;)
alert tcp $HOME_NET any -> 106.38.201.117 8001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102516; rev:2;)
alert tcp $HOME_NET any -> 106.38.201.117 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102515; rev:2;)
alert tcp $HOME_NET any -> 106.52.91.14 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102514; rev:2;)
alert tcp $HOME_NET any -> 106.52.166.133 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102513; rev:2;)
alert tcp $HOME_NET any -> 106.52.208.143 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102880; rev:2;)
alert tcp $HOME_NET any -> 106.52.238.253 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102512; rev:2;)
alert tcp $HOME_NET any -> 106.52.238.253 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102511; rev:2;)
alert tcp $HOME_NET any -> 106.53.172.234 8123 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105943; rev:2;)
alert tcp $HOME_NET any -> 106.53.172.234 30092 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101341; rev:2;)
alert tcp $HOME_NET any -> 106.54.44.169 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102879; rev:2;)
alert tcp $HOME_NET any -> 106.54.55.251 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102878; rev:2;)
alert tcp $HOME_NET any -> 106.54.240.229 8484 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104694; rev:2;)
alert tcp $HOME_NET any -> 106.54.241.250 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102877; rev:2;)
alert tcp $HOME_NET any -> 106.54.241.250 33899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106448; rev:2;)
alert tcp $HOME_NET any -> 106.55.25.39 54321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102876; rev:2;)
alert tcp $HOME_NET any -> 106.75.7.239 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105669; rev:2;)
alert tcp $HOME_NET any -> 106.75.7.239 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105942; rev:2;)
alert tcp $HOME_NET any -> 106.75.27.209 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102510; rev:2;)
alert tcp $HOME_NET any -> 106.75.209.40 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102875; rev:2;)
alert tcp $HOME_NET any -> 107.151.233.120 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100961; rev:2;)
alert tcp $HOME_NET any -> 107.161.86.90 5985 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104015; rev:2;)
alert tcp $HOME_NET any -> 107.161.168.217 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102509; rev:2;)
alert tcp $HOME_NET any -> 107.161.168.217 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102508; rev:2;)
alert tcp $HOME_NET any -> 107.172.63.153 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100958; rev:2;)
alert tcp $HOME_NET any -> 107.172.63.153 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101190; rev:2;)
alert tcp $HOME_NET any -> 107.172.80.241 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102507; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100955; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100957; rev:2;)
alert tcp $HOME_NET any -> 107.172.190.252 65530 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102506; rev:2;)
alert tcp $HOME_NET any -> 107.172.201.125 59009 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103630; rev:2;)
alert tcp $HOME_NET any -> 107.172.214.214 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102505; rev:2;)
alert tcp $HOME_NET any -> 107.172.255.93 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102504; rev:2;)
alert tcp $HOME_NET any -> 107.172.255.93 18989 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102503; rev:2;)
alert tcp $HOME_NET any -> 107.173.10.187 58082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103613; rev:2;)
alert tcp $HOME_NET any -> 107.173.13.251 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102502; rev:2;)
alert tcp $HOME_NET any -> 107.173.21.218 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102501; rev:2;)
alert tcp $HOME_NET any -> 107.173.51.146 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105609; rev:2;)
alert tcp $HOME_NET any -> 107.173.51.146 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105646; rev:2;)
alert tcp $HOME_NET any -> 107.173.85.194 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102500; rev:2;)
alert tcp $HOME_NET any -> 107.173.101.114 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102499; rev:2;)
alert tcp $HOME_NET any -> 107.173.144.112 8086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105941; rev:2;)
alert tcp $HOME_NET any -> 107.174.92.241 15672 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102498; rev:2;)
alert tcp $HOME_NET any -> 107.174.133.177 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102497; rev:2;)
alert tcp $HOME_NET any -> 107.174.186.201 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102496; rev:2;)
alert tcp $HOME_NET any -> 107.174.186.201 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102495; rev:2;)
alert tcp $HOME_NET any -> 107.175.94.184 61238 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106414; rev:2;)
alert tcp $HOME_NET any -> 108.160.138.37 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102494; rev:2;)
alert tcp $HOME_NET any -> 108.165.176.124 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102493; rev:2;)
alert tcp $HOME_NET any -> 108.165.176.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102492; rev:2;)
alert tcp $HOME_NET any -> 110.40.154.36 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102491; rev:2;)
alert tcp $HOME_NET any -> 110.41.77.213 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102490; rev:2;)
alert tcp $HOME_NET any -> 110.41.77.213 6667 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102489; rev:2;)
alert tcp $HOME_NET any -> 110.41.150.118 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106413; rev:2;)
alert tcp $HOME_NET any -> 110.41.162.83 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102488; rev:2;)
alert tcp $HOME_NET any -> 110.42.136.5 39003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102487; rev:2;)
alert tcp $HOME_NET any -> 110.42.211.101 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102874; rev:2;)
alert tcp $HOME_NET any -> 110.42.239.240 15588 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105940; rev:2;)
alert tcp $HOME_NET any -> 110.42.239.240 21481 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104693; rev:2;)
alert tcp $HOME_NET any -> 110.173.53.99 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102486; rev:2;)
alert tcp $HOME_NET any -> 111.228.2.9 50002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102485; rev:2;)
alert tcp $HOME_NET any -> 111.228.26.26 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102484; rev:2;)
alert tcp $HOME_NET any -> 111.228.27.89 5663 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106172; rev:2;)
alert tcp $HOME_NET any -> 111.228.27.89 5788 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106171; rev:2;)
alert tcp $HOME_NET any -> 111.228.35.42 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102483; rev:2;)
alert tcp $HOME_NET any -> 111.229.135.130 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102873; rev:2;)
alert tcp $HOME_NET any -> 111.229.135.130 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102872; rev:2;)
alert tcp $HOME_NET any -> 111.229.148.135 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106334; rev:2;)
alert tcp $HOME_NET any -> 111.229.153.119 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101189; rev:2;)
alert tcp $HOME_NET any -> 111.230.151.240 5544 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104301; rev:2;)
alert tcp $HOME_NET any -> 111.230.151.240 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104096; rev:2;)
alert tcp $HOME_NET any -> 112.124.44.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102482; rev:2;)
alert tcp $HOME_NET any -> 112.124.52.105 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103633; rev:2;)
alert tcp $HOME_NET any -> 112.124.52.105 8091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105939; rev:2;)
alert tcp $HOME_NET any -> 113.44.78.152 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102871; rev:2;)
alert tcp $HOME_NET any -> 113.44.78.152 18088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102870; rev:2;)
alert tcp $HOME_NET any -> 113.44.90.135 12346 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105935; rev:2;)
alert tcp $HOME_NET any -> 113.44.152.115 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102481; rev:2;)
alert tcp $HOME_NET any -> 113.45.28.96 8878 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102480; rev:2;)
alert tcp $HOME_NET any -> 113.45.168.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100959; rev:2;)
alert tcp $HOME_NET any -> 113.45.168.139 8433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103621; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102479; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55193 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102478; rev:2;)
alert tcp $HOME_NET any -> 113.45.176.42 55292 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102477; rev:2;)
alert tcp $HOME_NET any -> 113.45.196.228 222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102476; rev:2;)
alert tcp $HOME_NET any -> 113.45.206.160 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102475; rev:2;)
alert tcp $HOME_NET any -> 113.45.224.122 16688 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102474; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102473; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8848 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102472; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8869 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102471; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102470; rev:2;)
alert tcp $HOME_NET any -> 113.45.227.85 60000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102469; rev:2;)
alert tcp $HOME_NET any -> 113.45.253.80 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102468; rev:2;)
alert tcp $HOME_NET any -> 113.207.49.236 8000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102467; rev:2;)
alert tcp $HOME_NET any -> 113.250.188.15 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104178; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 8999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104585; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 9001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102466; rev:2;)
alert tcp $HOME_NET any -> 114.132.178.92 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100956; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.102 38584 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106080; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.144 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102465; rev:2;)
alert tcp $HOME_NET any -> 114.232.1.222 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105332; rev:2;)
alert tcp $HOME_NET any -> 115.29.162.68 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103949; rev:2;)
alert tcp $HOME_NET any -> 115.29.202.62 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102464; rev:2;)
alert tcp $HOME_NET any -> 115.29.241.139 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102463; rev:2;)
alert tcp $HOME_NET any -> 115.120.246.15 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102869; rev:2;)
alert tcp $HOME_NET any -> 115.159.45.186 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102462; rev:2;)
alert tcp $HOME_NET any -> 115.159.72.17 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106606; rev:2;)
alert tcp $HOME_NET any -> 115.159.111.226 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102461; rev:2;)
alert tcp $HOME_NET any -> 115.159.207.153 62119 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104300; rev:2;)
alert tcp $HOME_NET any -> 115.159.210.123 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104584; rev:2;)
alert tcp $HOME_NET any -> 115.159.210.123 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102868; rev:2;)
alert tcp $HOME_NET any -> 115.190.11.207 58084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102460; rev:2;)
alert tcp $HOME_NET any -> 115.190.178.137 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102459; rev:2;)
alert tcp $HOME_NET any -> 115.190.179.141 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104299; rev:2;)
alert tcp $HOME_NET any -> 115.190.191.200 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102458; rev:2;)
alert tcp $HOME_NET any -> 115.190.202.118 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102457; rev:2;)
alert tcp $HOME_NET any -> 115.190.209.209 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104968; rev:2;)
alert tcp $HOME_NET any -> 115.190.227.197 8001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102456; rev:2;)
alert tcp $HOME_NET any -> 115.190.231.244 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102455; rev:2;)
alert tcp $HOME_NET any -> 115.190.233.132 18080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102453; rev:2;)
alert tcp $HOME_NET any -> 115.190.234.72 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104298; rev:2;)
alert tcp $HOME_NET any -> 115.190.239.56 12312 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102454; rev:2;)
alert tcp $HOME_NET any -> 115.190.247.97 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103641; rev:2;)
alert tcp $HOME_NET any -> 115.191.19.20 44511 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106412; rev:2;)
alert tcp $HOME_NET any -> 116.62.64.55 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105532; rev:2;)
alert tcp $HOME_NET any -> 116.62.68.243 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102452; rev:2;)
alert tcp $HOME_NET any -> 116.62.130.3 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105331; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102451; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102450; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102449; rev:2;)
alert tcp $HOME_NET any -> 116.62.172.147 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102448; rev:2;)
alert tcp $HOME_NET any -> 116.62.226.163 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102447; rev:2;)
alert tcp $HOME_NET any -> 116.62.231.55 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102446; rev:2;)
alert tcp $HOME_NET any -> 116.196.75.154 60000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103644; rev:2;)
alert tcp $HOME_NET any -> 116.196.79.169 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102445; rev:2;)
alert tcp $HOME_NET any -> 116.204.119.99 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102444; rev:2;)
alert tcp $HOME_NET any -> 116.204.119.99 42314 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102443; rev:2;)
alert tcp $HOME_NET any -> 116.205.106.137 9997 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104678; rev:2;)
alert tcp $HOME_NET any -> 116.205.118.254 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104677; rev:2;)
alert tcp $HOME_NET any -> 116.205.137.86 3389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104583; rev:2;)
alert tcp $HOME_NET any -> 116.205.186.56 9080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102441; rev:2;)
alert tcp $HOME_NET any -> 117.50.175.117 50001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102440; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 7999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104582; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 8082 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104581; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104580; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104579; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102439; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 8921 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104578; rev:2;)
alert tcp $HOME_NET any -> 117.50.220.61 9008 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104577; rev:2;)
alert tcp $HOME_NET any -> 117.72.99.21 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104576; rev:2;)
alert tcp $HOME_NET any -> 117.72.100.236 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102867; rev:2;)
alert tcp $HOME_NET any -> 117.72.103.9 62521 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104575; rev:2;)
alert tcp $HOME_NET any -> 117.72.125.206 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104228; rev:2;)
alert tcp $HOME_NET any -> 117.72.148.131 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104676; rev:2;)
alert tcp $HOME_NET any -> 117.72.200.129 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104573; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 5003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106790; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 34551 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106789; rev:2;)
alert tcp $HOME_NET any -> 118.24.42.13 35871 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106788; rev:2;)
alert tcp $HOME_NET any -> 118.25.179.125 50001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104675; rev:2;)
alert tcp $HOME_NET any -> 118.25.192.79 16379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104572; rev:2;)
alert tcp $HOME_NET any -> 118.31.2.114 8000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104067; rev:2;)
alert tcp $HOME_NET any -> 118.31.2.114 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104066; rev:2;)
alert tcp $HOME_NET any -> 118.31.221.121 8899 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103608; rev:2;)
alert tcp $HOME_NET any -> 118.89.88.183 58086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105531; rev:2;)
alert tcp $HOME_NET any -> 118.89.124.88 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100954; rev:2;)
alert tcp $HOME_NET any -> 118.89.124.88 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101216; rev:2;)
alert tcp $HOME_NET any -> 118.99.55.153 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101340; rev:2;)
alert tcp $HOME_NET any -> 118.126.103.206 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104203; rev:2;)
alert tcp $HOME_NET any -> 118.126.104.234 20001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104571; rev:2;)
alert tcp $HOME_NET any -> 118.178.224.93 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106333; rev:2;)
alert tcp $HOME_NET any -> 118.195.158.209 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102866; rev:2;)
alert tcp $HOME_NET any -> 118.195.195.187 8787 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102865; rev:2;)
alert tcp $HOME_NET any -> 119.3.155.80 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101188; rev:2;)
alert tcp $HOME_NET any -> 119.29.139.137 4445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104570; rev:2;)
alert tcp $HOME_NET any -> 119.45.23.116 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102864; rev:2;)
alert tcp $HOME_NET any -> 119.45.23.116 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102863; rev:2;)
alert tcp $HOME_NET any -> 119.45.28.237 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105330; rev:2;)
alert tcp $HOME_NET any -> 119.45.102.168 61263 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103809; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102862; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102861; rev:2;)
alert tcp $HOME_NET any -> 119.45.105.71 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102860; rev:2;)
alert tcp $HOME_NET any -> 119.45.122.80 6398 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104966; rev:2;)
alert tcp $HOME_NET any -> 119.45.151.252 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104095; rev:2;)
alert tcp $HOME_NET any -> 119.45.160.160 18089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104569; rev:2;)
alert tcp $HOME_NET any -> 119.45.224.18 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101187; rev:2;)
alert tcp $HOME_NET any -> 119.45.231.164 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101221; rev:2;)
alert tcp $HOME_NET any -> 119.45.231.164 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101882; rev:2;)
alert tcp $HOME_NET any -> 119.91.32.43 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102438; rev:2;)
alert tcp $HOME_NET any -> 119.91.49.9 9876 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101217; rev:2;)
alert tcp $HOME_NET any -> 119.91.138.64 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102437; rev:2;)
alert tcp $HOME_NET any -> 119.91.138.64 4455 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102436; rev:2;)
alert tcp $HOME_NET any -> 119.91.140.188 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104568; rev:2;)
alert tcp $HOME_NET any -> 120.24.144.243 16001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105933; rev:2;)
alert tcp $HOME_NET any -> 120.26.14.56 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104674; rev:2;)
alert tcp $HOME_NET any -> 120.26.32.201 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106605; rev:2;)
alert tcp $HOME_NET any -> 120.26.120.83 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106604; rev:2;)
alert tcp $HOME_NET any -> 120.26.210.31 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104094; rev:2;)
alert tcp $HOME_NET any -> 120.26.236.53 3306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104673; rev:2;)
alert tcp $HOME_NET any -> 120.26.244.242 10081 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104672; rev:2;)
alert tcp $HOME_NET any -> 120.27.109.84 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106829; rev:2;)
alert tcp $HOME_NET any -> 120.27.109.84 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104671; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103603; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103602; rev:2;)
alert tcp $HOME_NET any -> 120.27.147.200 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104189; rev:2;)
alert tcp $HOME_NET any -> 120.48.19.37 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104567; rev:2;)
alert tcp $HOME_NET any -> 120.48.49.104 12346 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104670; rev:2;)
alert tcp $HOME_NET any -> 120.48.49.104 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101186; rev:2;)
alert tcp $HOME_NET any -> 120.48.122.238 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103632; rev:2;)
alert tcp $HOME_NET any -> 120.55.162.57 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104456; rev:2;)
alert tcp $HOME_NET any -> 120.55.193.6 9004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103887; rev:2;)
alert tcp $HOME_NET any -> 120.79.22.70 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105329; rev:2;)
alert tcp $HOME_NET any -> 120.79.24.24 65001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104669; rev:2;)
alert tcp $HOME_NET any -> 120.79.24.24 65002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104668; rev:2;)
alert tcp $HOME_NET any -> 120.92.48.211 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104223; rev:2;)
alert tcp $HOME_NET any -> 121.4.43.2 8830 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104297; rev:2;)
alert tcp $HOME_NET any -> 121.4.44.152 58888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102859; rev:2;)
alert tcp $HOME_NET any -> 121.4.92.72 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102858; rev:2;)
alert tcp $HOME_NET any -> 121.40.156.23 4567 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102435; rev:2;)
alert tcp $HOME_NET any -> 121.40.156.23 56789 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102434; rev:2;)
alert tcp $HOME_NET any -> 121.40.176.57 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102433; rev:2;)
alert tcp $HOME_NET any -> 121.41.1.158 60086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103619; rev:2;)
alert tcp $HOME_NET any -> 121.41.29.228 8004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104093; rev:2;)
alert tcp $HOME_NET any -> 121.89.84.19 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102432; rev:2;)
alert tcp $HOME_NET any -> 121.89.84.19 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102431; rev:2;)
alert tcp $HOME_NET any -> 121.89.94.37 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102430; rev:2;)
alert tcp $HOME_NET any -> 121.127.232.151 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102429; rev:2;)
alert tcp $HOME_NET any -> 121.229.36.89 30625 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102428; rev:2;)
alert tcp $HOME_NET any -> 122.10.5.218 808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102427; rev:2;)
alert tcp $HOME_NET any -> 122.10.5.218 8003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106603; rev:2;)
alert tcp $HOME_NET any -> 122.10.5.218 8007 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102426; rev:2;)
alert tcp $HOME_NET any -> 122.10.24.92 808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102425; rev:2;)
alert tcp $HOME_NET any -> 122.10.24.92 8003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102424; rev:2;)
alert tcp $HOME_NET any -> 122.10.24.92 8007 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102423; rev:2;)
alert tcp $HOME_NET any -> 122.10.52.27 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102422; rev:2;)
alert tcp $HOME_NET any -> 122.51.31.224 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104566; rev:2;)
alert tcp $HOME_NET any -> 122.51.48.49 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105931; rev:2;)
alert tcp $HOME_NET any -> 122.51.118.220 61616 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105932; rev:2;)
alert tcp $HOME_NET any -> 122.51.155.216 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104014; rev:2;)
alert tcp $HOME_NET any -> 122.51.247.79 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102857; rev:2;)
alert tcp $HOME_NET any -> 122.114.177.241 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105110; rev:2;)
alert tcp $HOME_NET any -> 122.152.196.122 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105086; rev:2;)
alert tcp $HOME_NET any -> 123.56.81.116 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102856; rev:2;)
alert tcp $HOME_NET any -> 123.56.83.34 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101527; rev:2;)
alert tcp $HOME_NET any -> 123.56.102.177 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104431; rev:2;)
alert tcp $HOME_NET any -> 123.56.116.92 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102421; rev:2;)
alert tcp $HOME_NET any -> 123.57.59.41 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106411; rev:2;)
alert tcp $HOME_NET any -> 123.57.59.41 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106332; rev:2;)
alert tcp $HOME_NET any -> 123.57.69.200 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102420; rev:2;)
alert tcp $HOME_NET any -> 123.57.69.200 61250 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104296; rev:2;)
alert tcp $HOME_NET any -> 123.57.190.245 8083 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102419; rev:2;)
alert tcp $HOME_NET any -> 123.57.230.183 60091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102855; rev:2;)
alert tcp $HOME_NET any -> 123.57.230.183 61012 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102854; rev:2;)
alert tcp $HOME_NET any -> 123.60.33.187 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102853; rev:2;)
alert tcp $HOME_NET any -> 123.60.84.127 8666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102418; rev:2;)
alert tcp $HOME_NET any -> 123.207.203.20 44512 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102852; rev:2;)
alert tcp $HOME_NET any -> 123.207.203.20 44513 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102851; rev:2;)
alert tcp $HOME_NET any -> 123.207.250.107 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102417; rev:2;)
alert tcp $HOME_NET any -> 123.254.106.168 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100951; rev:2;)
alert tcp $HOME_NET any -> 123.254.106.168 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100952; rev:2;)
alert tcp $HOME_NET any -> 124.70.142.36 8020 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102416; rev:2;)
alert tcp $HOME_NET any -> 124.160.46.2 9929 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102415; rev:2;)
alert tcp $HOME_NET any -> 124.220.0.201 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101185; rev:2;)
alert tcp $HOME_NET any -> 124.220.11.206 2550 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102850; rev:2;)
alert tcp $HOME_NET any -> 124.220.11.206 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102849; rev:2;)
alert tcp $HOME_NET any -> 124.220.25.149 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102414; rev:2;)
alert tcp $HOME_NET any -> 124.220.35.242 50443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102848; rev:2;)
alert tcp $HOME_NET any -> 124.220.55.115 1224 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105930; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 1227 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106331; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 1337 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102413; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 9527 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104565; rev:2;)
alert tcp $HOME_NET any -> 124.220.74.46 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102412; rev:2;)
alert tcp $HOME_NET any -> 124.220.212.113 59001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104564; rev:2;)
alert tcp $HOME_NET any -> 124.221.1.207 7788 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106602; rev:2;)
alert tcp $HOME_NET any -> 124.221.1.207 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105848; rev:2;)
alert tcp $HOME_NET any -> 124.221.46.243 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100941; rev:2;)
alert tcp $HOME_NET any -> 124.221.92.3 9922 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102411; rev:2;)
alert tcp $HOME_NET any -> 124.221.141.62 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102410; rev:2;)
alert tcp $HOME_NET any -> 124.221.175.211 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102847; rev:2;)
alert tcp $HOME_NET any -> 124.221.175.211 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102846; rev:2;)
alert tcp $HOME_NET any -> 124.221.195.107 81 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102845; rev:2;)
alert tcp $HOME_NET any -> 124.221.195.107 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102844; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 27001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101986; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 27002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101985; rev:2;)
alert tcp $HOME_NET any -> 124.222.37.250 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104563; rev:2;)
alert tcp $HOME_NET any -> 124.222.57.34 9998 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104562; rev:2;)
alert tcp $HOME_NET any -> 124.222.57.34 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101478; rev:2;)
alert tcp $HOME_NET any -> 124.222.69.132 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104561; rev:2;)
alert tcp $HOME_NET any -> 124.222.73.168 8844 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104667; rev:2;)
alert tcp $HOME_NET any -> 124.222.73.168 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104666; rev:2;)
alert tcp $HOME_NET any -> 124.222.79.201 61000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104560; rev:2;)
alert tcp $HOME_NET any -> 124.222.85.19 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102408; rev:2;)
alert tcp $HOME_NET any -> 124.222.99.196 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104665; rev:2;)
alert tcp $HOME_NET any -> 124.222.104.163 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105847; rev:2;)
alert tcp $HOME_NET any -> 124.222.128.197 4472 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104559; rev:2;)
alert tcp $HOME_NET any -> 124.222.128.197 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104558; rev:2;)
alert tcp $HOME_NET any -> 124.222.141.204 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102843; rev:2;)
alert tcp $HOME_NET any -> 124.222.144.44 63321 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102407; rev:2;)
alert tcp $HOME_NET any -> 124.222.147.241 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106330; rev:2;)
alert tcp $HOME_NET any -> 124.222.150.13 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100950; rev:2;)
alert tcp $HOME_NET any -> 124.222.210.55 9831 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104664; rev:2;)
alert tcp $HOME_NET any -> 124.222.210.55 59100 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102405; rev:2;)
alert tcp $HOME_NET any -> 124.222.229.235 58085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104557; rev:2;)
alert tcp $HOME_NET any -> 124.222.229.235 58320 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104556; rev:2;)
alert tcp $HOME_NET any -> 124.223.113.245 5432 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104555; rev:2;)
alert tcp $HOME_NET any -> 124.223.113.245 33389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105929; rev:2;)
alert tcp $HOME_NET any -> 124.223.156.196 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102404; rev:2;)
alert tcp $HOME_NET any -> 124.223.193.202 1234 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102403; rev:2;)
alert tcp $HOME_NET any -> 124.223.196.227 58084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102402; rev:2;)
alert tcp $HOME_NET any -> 124.223.198.8 50002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102401; rev:2;)
alert tcp $HOME_NET any -> 124.223.200.92 18443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104554; rev:2;)
alert tcp $HOME_NET any -> 124.223.209.153 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106601; rev:2;)
alert tcp $HOME_NET any -> 124.223.221.83 6666 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101184; rev:2;)
alert tcp $HOME_NET any -> 125.122.27.48 8090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102400; rev:2;)
alert tcp $HOME_NET any -> 129.28.44.165 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104013; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100939; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100944; rev:2;)
alert tcp $HOME_NET any -> 129.28.125.175 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102399; rev:2;)
alert tcp $HOME_NET any -> 129.204.10.223 8028 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101182; rev:2;)
alert tcp $HOME_NET any -> 129.204.196.251 2222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106787; rev:2;)
alert tcp $HOME_NET any -> 129.211.168.165 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100945; rev:2;)
alert tcp $HOME_NET any -> 129.211.168.165 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100946; rev:2;)
alert tcp $HOME_NET any -> 130.94.16.122 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105663; rev:2;)
alert tcp $HOME_NET any -> 130.94.16.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105630; rev:2;)
alert tcp $HOME_NET any -> 130.94.17.70 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103318; rev:2;)
alert tcp $HOME_NET any -> 130.94.30.168 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102398; rev:2;)
alert tcp $HOME_NET any -> 130.94.30.168 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102397; rev:2;)
alert tcp $HOME_NET any -> 130.94.33.140 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102396; rev:2;)
alert tcp $HOME_NET any -> 130.94.33.140 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104190; rev:2;)
alert tcp $HOME_NET any -> 130.94.66.82 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104459; rev:2;)
alert tcp $HOME_NET any -> 130.94.92.169 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102395; rev:2;)
alert tcp $HOME_NET any -> 130.94.92.169 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102394; rev:2;)
alert tcp $HOME_NET any -> 132.226.72.148 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102393; rev:2;)
alert tcp $HOME_NET any -> 132.232.245.164 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102392; rev:2;)
alert tcp $HOME_NET any -> 134.122.153.121 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102391; rev:2;)
alert tcp $HOME_NET any -> 134.122.154.92 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105653; rev:2;)
alert tcp $HOME_NET any -> 134.122.154.92 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105650; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104553; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104295; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104294; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.233 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104293; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104552; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104292; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.243 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104291; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104551; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104926; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8085 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104290; rev:2;)
alert tcp $HOME_NET any -> 134.122.155.245 8086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104289; rev:2;)
alert tcp $HOME_NET any -> 134.122.162.95 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104288; rev:2;)
alert tcp $HOME_NET any -> 134.175.86.167 21111 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104550; rev:2;)
alert tcp $HOME_NET any -> 134.209.214.178 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100949; rev:2;)
alert tcp $HOME_NET any -> 134.255.211.140 9300 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106786; rev:2;)
alert tcp $HOME_NET any -> 137.220.199.216 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102390; rev:2;)
alert tcp $HOME_NET any -> 137.220.251.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102389; rev:2;)
alert tcp $HOME_NET any -> 139.9.66.163 36127 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104549; rev:2;)
alert tcp $HOME_NET any -> 139.9.143.101 7711 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102842; rev:2;)
alert tcp $HOME_NET any -> 139.95.24.51 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104548; rev:2;)
alert tcp $HOME_NET any -> 139.129.36.253 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102388; rev:2;)
alert tcp $HOME_NET any -> 139.155.42.198 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102387; rev:2;)
alert tcp $HOME_NET any -> 139.155.138.221 60001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103808; rev:2;)
alert tcp $HOME_NET any -> 139.155.148.102 13389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102386; rev:2;)
alert tcp $HOME_NET any -> 139.159.153.21 1086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102385; rev:2;)
alert tcp $HOME_NET any -> 139.180.128.42 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102384; rev:2;)
alert tcp $HOME_NET any -> 139.180.219.233 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102383; rev:2;)
alert tcp $HOME_NET any -> 139.180.222.237 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102382; rev:2;)
alert tcp $HOME_NET any -> 139.180.222.237 8321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102381; rev:2;)
alert tcp $HOME_NET any -> 139.196.170.151 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104287; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104663; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8456 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105085; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8808 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104662; rev:2;)
alert tcp $HOME_NET any -> 139.196.181.1 8809 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104661; rev:2;)
alert tcp $HOME_NET any -> 139.196.238.43 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102380; rev:2;)
alert tcp $HOME_NET any -> 139.199.18.159 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103807; rev:2;)
alert tcp $HOME_NET any -> 139.199.80.221 8016 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104925; rev:2;)
alert tcp $HOME_NET any -> 139.199.80.221 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106170; rev:2;)
alert tcp $HOME_NET any -> 139.224.3.228 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104660; rev:2;)
alert tcp $HOME_NET any -> 140.143.87.68 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104659; rev:2;)
alert tcp $HOME_NET any -> 140.143.87.68 9443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104658; rev:2;)
alert tcp $HOME_NET any -> 140.210.136.68 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104092; rev:2;)
alert tcp $HOME_NET any -> 142.4.58.48 1223 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102379; rev:2;)
alert tcp $HOME_NET any -> 142.4.58.48 1224 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102378; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102377; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102376; rev:2;)
alert tcp $HOME_NET any -> 143.92.51.145 18083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102375; rev:2;)
alert tcp $HOME_NET any -> 143.92.62.62 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106410; rev:2;)
alert tcp $HOME_NET any -> 143.92.62.62 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106329; rev:2;)
alert tcp $HOME_NET any -> 143.246.202.156 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106409; rev:2;)
alert tcp $HOME_NET any -> 144.7.106.78 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102840; rev:2;)
alert tcp $HOME_NET any -> 144.202.26.27 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102374; rev:2;)
alert tcp $HOME_NET any -> 144.225.137.26 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105328; rev:2;)
alert tcp $HOME_NET any -> 145.79.143.166 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101339; rev:2;)
alert tcp $HOME_NET any -> 145.79.143.166 8000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104547; rev:2;)
alert tcp $HOME_NET any -> 145.79.143.166 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104546; rev:2;)
alert tcp $HOME_NET any -> 146.19.213.28 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106785; rev:2;)
alert tcp $HOME_NET any -> 146.56.204.18 8024 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105327; rev:2;)
alert tcp $HOME_NET any -> 146.56.239.16 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101625; rev:2;)
alert tcp $HOME_NET any -> 146.190.127.76 10000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102373; rev:2;)
alert tcp $HOME_NET any -> 146.235.216.7 54321 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104545; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104544; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106056; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106055; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106054; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106053; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102372; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103806; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106408; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106407; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106406; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104091; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106784; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106783; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106782; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102371; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102370; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106052; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106051; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106050; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102369; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102368; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106049; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106048; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106047; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106046; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105674; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105616; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105625; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105927; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105926; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105654; rev:2;)
alert tcp $HOME_NET any -> 149.28.30.98 8090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105928; rev:2;)
alert tcp $HOME_NET any -> 149.28.132.51 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102367; rev:2;)
alert tcp $HOME_NET any -> 149.28.135.144 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102366; rev:2;)
alert tcp $HOME_NET any -> 149.28.139.62 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102365; rev:2;)
alert tcp $HOME_NET any -> 149.30.247.60 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102364; rev:2;)
alert tcp $HOME_NET any -> 149.30.247.60 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102363; rev:2;)
alert tcp $HOME_NET any -> 149.62.46.110 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104090; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.99 2222 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102362; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.229 8889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104543; rev:2;)
alert tcp $HOME_NET any -> 149.104.21.33 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101582; rev:2;)
alert tcp $HOME_NET any -> 149.104.28.204 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100948; rev:2;)
alert tcp $HOME_NET any -> 149.104.28.204 61372 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106083; rev:2;)
alert tcp $HOME_NET any -> 149.248.76.53 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102361; rev:2;)
alert tcp $HOME_NET any -> 150.109.94.129 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100947; rev:2;)
alert tcp $HOME_NET any -> 150.109.94.129 6666 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101180; rev:2;)
alert tcp $HOME_NET any -> 150.129.80.247 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101215; rev:2;)
alert tcp $HOME_NET any -> 150.158.27.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102839; rev:2;)
alert tcp $HOME_NET any -> 150.158.30.251 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102838; rev:2;)
alert tcp $HOME_NET any -> 150.158.30.251 18089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102837; rev:2;)
alert tcp $HOME_NET any -> 150.158.86.86 10089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102180; rev:2;)
alert tcp $HOME_NET any -> 150.158.102.111 8049 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102836; rev:2;)
alert tcp $HOME_NET any -> 150.158.102.111 8050 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102835; rev:2;)
alert tcp $HOME_NET any -> 150.230.62.206 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102360; rev:2;)
alert tcp $HOME_NET any -> 150.242.245.62 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102359; rev:2;)
alert tcp $HOME_NET any -> 150.242.246.106 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101526; rev:2;)
alert tcp $HOME_NET any -> 151.242.189.246 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102358; rev:2;)
alert tcp $HOME_NET any -> 151.243.137.78 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102357; rev:2;)
alert tcp $HOME_NET any -> 151.243.229.224 8086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101179; rev:2;)
alert tcp $HOME_NET any -> 151.245.90.134 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100943; rev:2;)
alert tcp $HOME_NET any -> 151.245.121.11 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102356; rev:2;)
alert tcp $HOME_NET any -> 152.32.171.230 65534 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102355; rev:2;)
alert tcp $HOME_NET any -> 152.32.201.214 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102354; rev:2;)
alert tcp $HOME_NET any -> 152.32.201.214 25992 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102353; rev:2;)
alert tcp $HOME_NET any -> 152.32.201.214 25994 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105084; rev:2;)
alert tcp $HOME_NET any -> 152.32.210.65 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102352; rev:2;)
alert tcp $HOME_NET any -> 152.42.211.112 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102351; rev:2;)
alert tcp $HOME_NET any -> 152.42.211.112 14357 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102350; rev:2;)
alert tcp $HOME_NET any -> 152.67.33.246 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102349; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102348; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102347; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102346; rev:2;)
alert tcp $HOME_NET any -> 152.136.38.231 20005 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102345; rev:2;)
alert tcp $HOME_NET any -> 152.136.200.205 43691 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102344; rev:2;)
alert tcp $HOME_NET any -> 153.75.224.136 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102343; rev:2;)
alert tcp $HOME_NET any -> 154.8.136.171 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103296; rev:2;)
alert tcp $HOME_NET any -> 154.8.155.90 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106600; rev:2;)
alert tcp $HOME_NET any -> 154.12.37.146 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103629; rev:2;)
alert tcp $HOME_NET any -> 154.12.92.28 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102342; rev:2;)
alert tcp $HOME_NET any -> 154.31.216.202 9290 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102341; rev:2;)
alert tcp $HOME_NET any -> 154.31.216.202 29000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102340; rev:2;)
alert tcp $HOME_NET any -> 154.31.217.202 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102339; rev:2;)
alert tcp $HOME_NET any -> 154.31.217.202 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102338; rev:2;)
alert tcp $HOME_NET any -> 154.36.163.65 53389 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102337; rev:2;)
alert tcp $HOME_NET any -> 154.36.163.65 63350 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102336; rev:2;)
alert tcp $HOME_NET any -> 154.62.226.131 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102335; rev:2;)
alert tcp $HOME_NET any -> 154.64.245.88 15004 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102334; rev:2;)
alert tcp $HOME_NET any -> 154.64.245.88 15005 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102333; rev:2;)
alert tcp $HOME_NET any -> 154.81.34.82 13389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102332; rev:2;)
alert tcp $HOME_NET any -> 154.86.30.94 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101178; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102834; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102833; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104657; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102832; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102831; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102830; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102829; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102828; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102827; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102826; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105897; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105899; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102825; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102824; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102823; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102820; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102822; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102821; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102331; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102330; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102819; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102818; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102817; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102815; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102816; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102814; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105908; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102329; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.50 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102328; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102813; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102812; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102811; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102810; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102809; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102806; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102805; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102804; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102803; rev:2;)
alert tcp $HOME_NET any -> 154.88.96.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102783; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102792; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102779; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105903; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105898; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102782; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102799; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105905; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102798; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102781; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102784; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102790; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102797; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102786; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102780; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102787; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102796; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102791; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102795; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102785; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102327; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102326; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102793; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102788; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102778; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102789; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102325; rev:2;)
alert tcp $HOME_NET any -> 154.88.97.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102324; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105902; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102323; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102322; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102321; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102320; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105875; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102319; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102318; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102317; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102316; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102315; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102314; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.40 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102777; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102794; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102801; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102802; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102800; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102776; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102775; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102774; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102773; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102761; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102770; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102772; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102313; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102312; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102771; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102766; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105882; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102311; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102310; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102309; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102308; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102307; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102306; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105879; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102305; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102304; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102303; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102302; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102301; rev:2;)
alert tcp $HOME_NET any -> 154.88.98.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102300; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102754; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102769; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102299; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102298; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104656; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104655; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102768; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102767; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102765; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102753; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105880; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105885; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.41 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105873; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104654; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102297; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102296; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102295; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102759; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102762; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102755; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102751; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102748; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102750; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102763; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102764; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102752; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102757; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105891; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105892; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102760; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102756; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102749; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102758; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102747; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102746; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102745; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102744; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102743; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102742; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102741; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102740; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102739; rev:2;)
alert tcp $HOME_NET any -> 154.88.99.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102738; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102294; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102293; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105925; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103601; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103600; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104653; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103599; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103598; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103597; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103596; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103595; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103594; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103593; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105920; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103592; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103591; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104652; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103590; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103589; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103588; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103587; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103586; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.51 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103585; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.51 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103584; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103583; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103582; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103581; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103579; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103580; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.55 8885 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104651; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104650; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104649; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103578; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103577; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103576; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103575; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103574; rev:2;)
alert tcp $HOME_NET any -> 154.88.100.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103573; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105894; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105922; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103571; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103572; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103570; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103569; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103568; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103567; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.41 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103566; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.41 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103565; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103564; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103563; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103562; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103561; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.45 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103560; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103559; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105918; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.49 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103558; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.49 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103557; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105916; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105896; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103556; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103555; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105917; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.56 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105915; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105919; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105904; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103554; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103553; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105914; rev:2;)
alert tcp $HOME_NET any -> 154.88.101.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105910; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.33 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103552; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.33 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103551; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.34 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103550; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103549; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105909; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105876; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.38 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103548; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.38 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103547; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103546; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.39 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103545; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.43 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103544; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.43 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103543; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103542; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103540; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.45 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105912; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.46 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105901; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105900; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103541; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103539; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103538; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103537; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.53 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103536; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.53 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103535; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.54 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103534; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.54 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103533; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103532; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103531; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103530; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103529; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.61 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103528; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103527; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103526; rev:2;)
alert tcp $HOME_NET any -> 154.88.102.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103525; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.34 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105890; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.35 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103524; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.35 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103523; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.36 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103522; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.36 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103521; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.37 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103520; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.37 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103519; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.39 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105895; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.40 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103518; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.40 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103517; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.42 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105874; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.42 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105906; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.44 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103516; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.44 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103515; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.46 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105907; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.47 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103514; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.47 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103513; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.48 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103512; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.48 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103511; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.50 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103510; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.50 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103509; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.52 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103508; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.52 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103507; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.55 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102737; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.55 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102736; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.56 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105913; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.57 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102735; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.57 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102734; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.58 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103506; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.58 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103505; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.59 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103504; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.59 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103503; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.60 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102733; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.60 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102732; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.61 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105911; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.62 8884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103502; rev:2;)
alert tcp $HOME_NET any -> 154.88.103.62 8885 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103501; rev:2;)
alert tcp $HOME_NET any -> 154.89.148.121 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105893; rev:2;)
alert tcp $HOME_NET any -> 154.89.152.34 20145 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103372; rev:2;)
alert tcp $HOME_NET any -> 154.89.152.200 3306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102731; rev:2;)
alert tcp $HOME_NET any -> 154.89.195.170 33060 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102730; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106327; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106169; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105530; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106405; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106404; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104648; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104647; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104646; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104645; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105529; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104644; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.104 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104924; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105083; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105889; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105326; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105325; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105324; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104643; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104642; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104641; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104640; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106168; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105140; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105528; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105527; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105082; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105526; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105525; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105524; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104639; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106326; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106167; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105523; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105139; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104638; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104637; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105522; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104636; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104635; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106188; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105888; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104634; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105521; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104633; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104923; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104632; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106599; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104631; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104630; rev:2;)
alert tcp $HOME_NET any -> 154.91.56.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104629; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106403; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105520; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.99 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104430; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.99 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104429; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105138; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104428; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.101 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104427; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105519; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106166; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.103 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104426; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105517; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105516; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105518; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105137; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.107 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104425; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106323; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106045; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105515; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105514; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.111 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104423; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104628; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104627; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106044; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105513; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106319; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106325; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105511; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105512; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106324; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105322; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104422; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105320; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.121 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104626; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.121 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104420; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.122 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104419; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104625; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.123 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104418; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.124 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104417; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104624; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104623; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104622; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105509; rev:2;)
alert tcp $HOME_NET any -> 154.91.57.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105510; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105323; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106598; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.99 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104416; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.100 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104415; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104414; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105877; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.101 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104413; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105081; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106595; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105508; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.104 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104412; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.104 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104410; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105321; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105080; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105506; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105507; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105502; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105504; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105136; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105505; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106597; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.110 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104409; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106165; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.111 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104408; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106596; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105503; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106594; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105319; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.114 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103886; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105079; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.115 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104407; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.116 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104406; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.116 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104405; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.117 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104404; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.117 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104403; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106320; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106322; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.119 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105135; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105078; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.120 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104402; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.120 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104401; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.121 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104400; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.121 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104399; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106593; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105317; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.123 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104398; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.123 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104397; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.124 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104396; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.124 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104395; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.125 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104394; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.125 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104393; rev:2;)
alert tcp $HOME_NET any -> 154.91.58.126 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104392; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.98 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104391; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.98 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104390; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105499; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105501; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105316; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105134; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106321; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105887; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106043; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105496; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105498; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106042; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105500; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106316; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.106 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104389; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105479; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104621; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.108 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104388; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104620; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106592; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105495; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104619; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106039; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106310; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106041; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105497; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105492; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106040; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105494; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105318; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105133; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105493; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106400; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.118 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104387; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.119 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104386; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104385; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106401; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106318; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105486; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106164; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106314; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105075; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.124 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104384; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106313; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.126 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104381; rev:2;)
alert tcp $HOME_NET any -> 154.91.59.126 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104383; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106317; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106315; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106130; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106038; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105490; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105491; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106187; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.102 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104382; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105489; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.104 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104380; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.104 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104379; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106589; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106306; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105077; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.106 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104378; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105886; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105488; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106037; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105487; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105485; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105484; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106402; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106591; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105481; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106036; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105483; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106312; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106309; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106590; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106399; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105480; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106035; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105482; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.118 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104377; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.118 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104376; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.119 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104375; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.119 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104374; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.120 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104373; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.120 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104372; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.121 8074 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104371; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104618; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105478; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106307; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106311; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106308; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104617; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104370; rev:2;)
alert tcp $HOME_NET any -> 154.91.60.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104616; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105076; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.98 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104369; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106186; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106131; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.100 8094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104368; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106588; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104367; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104366; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104365; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106185; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104364; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104363; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104362; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104614; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104361; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104360; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105476; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105477; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104615; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104358; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.112 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104359; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105474; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106398; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105475; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104613; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104355; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104357; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104356; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106587; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104350; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104354; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104349; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104353; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104345; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104352; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104340; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106034; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104351; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104343; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104348; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104341; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104346; rev:2;)
alert tcp $HOME_NET any -> 154.91.61.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104347; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104344; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104342; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106395; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106303; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.100 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105074; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104339; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.101 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106184; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106180; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104338; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104335; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106033; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106028; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.104 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104337; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104336; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104334; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.106 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106583; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104612; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.107 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106029; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106032; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106030; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106031; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104333; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104332; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106304; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106302; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104331; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.113 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104330; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104329; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104328; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106027; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106026; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104327; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104326; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106585; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106025; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106024; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106023; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106183; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106179; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106022; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106297; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106296; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104611; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.125 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104325; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104324; rev:2;)
alert tcp $HOME_NET any -> 154.91.62.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106021; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.98 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106586; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.98 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105073; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.99 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106579; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.99 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106305; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.100 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106020; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.101 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106182; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.102 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106396; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.102 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106298; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.103 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105072; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.103 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104323; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.104 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104322; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.105 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106584; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.105 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104321; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.106 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105132; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.107 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106397; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.108 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106181; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.108 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106129; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.109 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106178; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.109 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106019; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.110 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105315; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.110 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105309; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.111 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105473; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.111 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105313; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.112 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105314; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.113 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105311; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.114 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104320; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.114 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104319; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.115 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105308; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.115 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105305; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.116 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106301; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.116 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105312; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.117 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106580; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.117 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104318; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.118 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104317; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.118 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104316; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.119 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105307; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.119 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105310; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.120 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106581; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.120 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106300; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.121 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104315; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.121 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105071; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.122 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106176; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.122 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106175; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.123 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106578; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.123 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106299; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.124 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104314; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.124 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104313; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.125 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105306; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.126 8074 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106582; rev:2;)
alert tcp $HOME_NET any -> 154.91.63.126 8094 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106177; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.61 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102729; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101524; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102728; rev:2;)
alert tcp $HOME_NET any -> 154.91.180.246 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101523; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105664; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 8334 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105884; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105670; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100940; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 8334 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102727; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100942; rev:2;)
alert tcp $HOME_NET any -> 154.93.103.232 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104610; rev:2;)
alert tcp $HOME_NET any -> 154.194.251.43 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104012; rev:2;)
alert tcp $HOME_NET any -> 154.206.98.85 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103500; rev:2;)
alert tcp $HOME_NET any -> 154.206.99.60 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103499; rev:2;)
alert tcp $HOME_NET any -> 154.211.86.169 40000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104286; rev:2;)
alert tcp $HOME_NET any -> 154.211.92.190 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104089; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103498; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103497; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8384 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105924; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8484 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105070; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8489 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103496; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8584 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103495; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8589 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105923; rev:2;)
alert tcp $HOME_NET any -> 154.217.234.104 8991 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103494; rev:2;)
alert tcp $HOME_NET any -> 154.221.17.62 18080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101214; rev:2;)
alert tcp $HOME_NET any -> 154.223.16.184 4388 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103493; rev:2;)
alert tcp $HOME_NET any -> 155.94.144.168 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100937; rev:2;)
alert tcp $HOME_NET any -> 155.117.20.62 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103643; rev:2;)
alert tcp $HOME_NET any -> 155.117.46.184 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105883; rev:2;)
alert tcp $HOME_NET any -> 155.117.224.68 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102726; rev:2;)
alert tcp $HOME_NET any -> 156.238.120.13 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102725; rev:2;)
alert tcp $HOME_NET any -> 156.238.122.188 8801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102724; rev:2;)
alert tcp $HOME_NET any -> 156.238.224.156 5522 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101213; rev:2;)
alert tcp $HOME_NET any -> 156.238.224.156 5533 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103492; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102723; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102722; rev:2;)
alert tcp $HOME_NET any -> 156.238.237.103 801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102721; rev:2;)
alert tcp $HOME_NET any -> 156.239.238.204 7777 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105069; rev:2;)
alert tcp $HOME_NET any -> 156.244.9.19 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102720; rev:2;)
alert tcp $HOME_NET any -> 156.244.9.19 9094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102719; rev:2;)
alert tcp $HOME_NET any -> 156.248.73.82 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102718; rev:2;)
alert tcp $HOME_NET any -> 156.248.73.82 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102717; rev:2;)
alert tcp $HOME_NET any -> 156.248.73.83 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100938; rev:2;)
alert tcp $HOME_NET any -> 156.248.73.84 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102716; rev:2;)
alert tcp $HOME_NET any -> 156.248.73.84 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102715; rev:2;)
alert tcp $HOME_NET any -> 156.251.16.125 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104011; rev:2;)
alert tcp $HOME_NET any -> 156.251.16.126 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105068; rev:2;)
alert tcp $HOME_NET any -> 156.251.16.131 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104088; rev:2;)
alert tcp $HOME_NET any -> 156.251.16.136 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104010; rev:2;)
alert tcp $HOME_NET any -> 158.94.209.159 9981 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105881; rev:2;)
alert tcp $HOME_NET any -> 159.75.118.45 9090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102714; rev:2;)
alert tcp $HOME_NET any -> 159.75.135.128 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102713; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 8087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102712; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 18087 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102711; rev:2;)
alert tcp $HOME_NET any -> 159.75.158.207 28287 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102710; rev:2;)
alert tcp $HOME_NET any -> 159.100.9.55 18081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103491; rev:2;)
alert tcp $HOME_NET any -> 160.25.134.148 559 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103490; rev:2;)
alert tcp $HOME_NET any -> 160.25.134.148 8964 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104312; rev:2;)
alert tcp $HOME_NET any -> 160.124.88.200 30004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105878; rev:2;)
alert tcp $HOME_NET any -> 160.191.77.210 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102709; rev:2;)
alert tcp $HOME_NET any -> 160.202.230.186 9091 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102708; rev:2;)
alert tcp $HOME_NET any -> 162.14.99.178 61080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102707; rev:2;)
alert tcp $HOME_NET any -> 162.14.116.65 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102706; rev:2;)
alert tcp $HOME_NET any -> 163.5.102.34 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103489; rev:2;)
alert tcp $HOME_NET any -> 165.154.6.188 1389 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102705; rev:2;)
alert tcp $HOME_NET any -> 165.154.45.137 65533 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102704; rev:2;)
alert tcp $HOME_NET any -> 165.154.132.203 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102703; rev:2;)
alert tcp $HOME_NET any -> 165.154.205.34 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105659; rev:2;)
alert tcp $HOME_NET any -> 165.154.205.34 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105658; rev:2;)
alert tcp $HOME_NET any -> 165.154.205.178 21480 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102702; rev:2;)
alert tcp $HOME_NET any -> 165.154.205.178 38080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102701; rev:2;)
alert tcp $HOME_NET any -> 165.154.226.87 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101210; rev:2;)
alert tcp $HOME_NET any -> 165.154.241.51 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103488; rev:2;)
alert tcp $HOME_NET any -> 166.0.27.224 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103487; rev:2;)
alert tcp $HOME_NET any -> 166.88.90.53 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103486; rev:2;)
alert tcp $HOME_NET any -> 166.88.97.92 808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105872; rev:2;)
alert tcp $HOME_NET any -> 166.88.209.196 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103485; rev:2;)
alert tcp $HOME_NET any -> 166.88.209.196 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103484; rev:2;)
alert tcp $HOME_NET any -> 167.17.47.58 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102700; rev:2;)
alert tcp $HOME_NET any -> 167.71.203.78 47363 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102699; rev:2;)
alert tcp $HOME_NET any -> 167.71.215.243 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103885; rev:2;)
alert tcp $HOME_NET any -> 167.160.191.220 10008 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103483; rev:2;)
alert tcp $HOME_NET any -> 167.179.76.179 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101441; rev:2;)
alert tcp $HOME_NET any -> 169.239.128.75 8082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101209; rev:2;)
alert tcp $HOME_NET any -> 169.239.128.75 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100934; rev:2;)
alert tcp $HOME_NET any -> 170.106.188.119 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103482; rev:2;)
alert tcp $HOME_NET any -> 170.205.31.53 8083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103481; rev:2;)
alert tcp $HOME_NET any -> 171.80.1.116 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102698; rev:2;)
alert tcp $HOME_NET any -> 172.233.87.220 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106394; rev:2;)
alert tcp $HOME_NET any -> 172.233.87.220 9100 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102697; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.42 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105304; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.160 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106393; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.160 3306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105472; rev:2;)
alert tcp $HOME_NET any -> 172.245.80.41 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105618; rev:2;)
alert tcp $HOME_NET any -> 172.245.126.122 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103480; rev:2;)
alert tcp $HOME_NET any -> 172.245.168.240 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104009; rev:2;)
alert tcp $HOME_NET any -> 173.211.46.220 53306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103479; rev:2;)
alert tcp $HOME_NET any -> 173.211.46.220 56379 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103478; rev:2;)
alert tcp $HOME_NET any -> 173.242.114.162 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103477; rev:2;)
alert tcp $HOME_NET any -> 173.249.24.135 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103476; rev:2;)
alert tcp $HOME_NET any -> 173.249.206.44 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104311; rev:2;)
alert tcp $HOME_NET any -> 173.249.206.44 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104087; rev:2;)
alert tcp $HOME_NET any -> 173.249.220.138 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103475; rev:2;)
alert tcp $HOME_NET any -> 173.249.220.138 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104609; rev:2;)
alert tcp $HOME_NET any -> 173.254.211.27 2096 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105671; rev:2;)
alert tcp $HOME_NET any -> 175.27.140.230 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102696; rev:2;)
alert tcp $HOME_NET any -> 175.27.164.199 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104922; rev:2;)
alert tcp $HOME_NET any -> 175.41.169.29 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104008; rev:2;)
alert tcp $HOME_NET any -> 175.178.12.127 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102695; rev:2;)
alert tcp $HOME_NET any -> 175.178.24.97 7890 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102694; rev:2;)
alert tcp $HOME_NET any -> 175.186.0.57 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102693; rev:2;)
alert tcp $HOME_NET any -> 178.16.52.120 8767 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102692; rev:2;)
alert tcp $HOME_NET any -> 178.16.52.120 8787 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101173; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102691; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102690; rev:2;)
alert tcp $HOME_NET any -> 178.16.53.91 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102689; rev:2;)
alert tcp $HOME_NET any -> 178.104.160.172 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103474; rev:2;)
alert tcp $HOME_NET any -> 178.128.18.57 3028 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102688; rev:2;)
alert tcp $HOME_NET any -> 178.128.18.57 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102687; rev:2;)
alert tcp $HOME_NET any -> 180.76.53.183 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102686; rev:2;)
alert tcp $HOME_NET any -> 180.76.53.183 4433 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102685; rev:2;)
alert tcp $HOME_NET any -> 180.76.103.53 8811 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105871; rev:2;)
alert tcp $HOME_NET any -> 180.76.121.70 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102684; rev:2;)
alert tcp $HOME_NET any -> 180.76.135.85 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100936; rev:2;)
alert tcp $HOME_NET any -> 180.76.250.42 6379 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102683; rev:2;)
alert tcp $HOME_NET any -> 180.76.250.42 8007 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102682; rev:2;)
alert tcp $HOME_NET any -> 180.76.250.42 9988 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102681; rev:2;)
alert tcp $HOME_NET any -> 180.184.27.161 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102680; rev:2;)
alert tcp $HOME_NET any -> 180.184.46.116 10059 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105303; rev:2;)
alert tcp $HOME_NET any -> 180.184.46.116 10086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105302; rev:2;)
alert tcp $HOME_NET any -> 182.61.148.201 10445 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104310; rev:2;)
alert tcp $HOME_NET any -> 182.61.148.201 13306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102678; rev:2;)
alert tcp $HOME_NET any -> 182.92.62.124 51001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102677; rev:2;)
alert tcp $HOME_NET any -> 182.92.69.30 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106018; rev:2;)
alert tcp $HOME_NET any -> 182.92.188.8 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102676; rev:2;)
alert tcp $HOME_NET any -> 182.92.188.8 500 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102675; rev:2;)
alert tcp $HOME_NET any -> 182.92.242.6 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104007; rev:2;)
alert tcp $HOME_NET any -> 182.254.146.29 55555 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102674; rev:2;)
alert tcp $HOME_NET any -> 182.254.162.240 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103815; rev:2;)
alert tcp $HOME_NET any -> 182.255.89.106 10421 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103473; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.178 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100935; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.178 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100932; rev:2;)
alert tcp $HOME_NET any -> 185.242.3.178 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100933; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102673; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102672; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102671; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102670; rev:2;)
alert tcp $HOME_NET any -> 185.244.212.122 8591 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105471; rev:2;)
alert tcp $HOME_NET any -> 186.241.68.124 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102669; rev:2;)
alert tcp $HOME_NET any -> 188.119.65.98 8004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102668; rev:2;)
alert tcp $HOME_NET any -> 191.223.208.216 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104608; rev:2;)
alert tcp $HOME_NET any -> 191.223.208.216 8443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104607; rev:2;)
alert tcp $HOME_NET any -> 192.3.98.166 55555 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102667; rev:2;)
alert tcp $HOME_NET any -> 192.3.211.176 19999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103472; rev:2;)
alert tcp $HOME_NET any -> 192.25.102.246 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101622; rev:2;)
alert tcp $HOME_NET any -> 192.53.112.82 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102666; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 7777 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101168; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 9999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102665; rev:2;)
alert tcp $HOME_NET any -> 192.129.141.183 18886 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102664; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 822 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102663; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 4431 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102662; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 4451 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102661; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 5781 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102660; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 8989 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102659; rev:2;)
alert tcp $HOME_NET any -> 192.140.174.170 45454 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102658; rev:2;)
alert tcp $HOME_NET any -> 192.144.156.56 56789 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102657; rev:2;)
alert tcp $HOME_NET any -> 192.144.168.105 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101623; rev:2;)
alert tcp $HOME_NET any -> 192.144.219.65 8089 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102656; rev:2;)
alert tcp $HOME_NET any -> 192.144.219.65 8099 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104606; rev:2;)
alert tcp $HOME_NET any -> 192.187.118.178 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104309; rev:2;)
alert tcp $HOME_NET any -> 192.210.193.156 8090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105870; rev:2;)
alert tcp $HOME_NET any -> 192.227.167.203 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102655; rev:2;)
alert tcp $HOME_NET any -> 192.227.235.182 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104086; rev:2;)
alert tcp $HOME_NET any -> 192.227.235.182 50000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104308; rev:2;)
alert tcp $HOME_NET any -> 192.236.151.33 65530 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103614; rev:2;)
alert tcp $HOME_NET any -> 192.236.223.240 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102654; rev:2;)
alert tcp $HOME_NET any -> 192.238.141.140 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104605; rev:2;)
alert tcp $HOME_NET any -> 192.243.120.239 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102653; rev:2;)
alert tcp $HOME_NET any -> 192.255.128.122 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102652; rev:2;)
alert tcp $HOME_NET any -> 192.255.128.122 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102651; rev:2;)
alert tcp $HOME_NET any -> 192.255.132.233 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104307; rev:2;)
alert tcp $HOME_NET any -> 192.255.236.156 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104604; rev:2;)
alert tcp $HOME_NET any -> 193.42.24.215 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105682; rev:2;)
alert tcp $HOME_NET any -> 193.42.24.215 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106417; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102650; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 8989 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104006; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 9898 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102649; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 15443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101207; rev:2;)
alert tcp $HOME_NET any -> 193.112.28.215 18090 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105470; rev:2;)
alert tcp $HOME_NET any -> 193.112.172.196 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102648; rev:2;)
alert tcp $HOME_NET any -> 193.112.200.118 8003 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105869; rev:2;)
alert tcp $HOME_NET any -> 193.134.209.166 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100930; rev:2;)
alert tcp $HOME_NET any -> 193.149.190.66 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102647; rev:2;)
alert tcp $HOME_NET any -> 193.160.32.138 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101206; rev:2;)
alert tcp $HOME_NET any -> 194.26.73.23 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102646; rev:2;)
alert tcp $HOME_NET any -> 194.150.166.179 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100931; rev:2;)
alert tcp $HOME_NET any -> 194.180.206.163 19181 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103635; rev:2;)
alert tcp $HOME_NET any -> 194.213.18.117 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105621; rev:2;)
alert tcp $HOME_NET any -> 194.213.18.117 8082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105868; rev:2;)
alert tcp $HOME_NET any -> 195.114.193.201 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102645; rev:2;)
alert tcp $HOME_NET any -> 198.12.77.134 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105620; rev:2;)
alert tcp $HOME_NET any -> 198.23.228.112 39001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101152; rev:2;)
alert tcp $HOME_NET any -> 198.44.46.122 6666 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102644; rev:2;)
alert tcp $HOME_NET any -> 198.44.116.140 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104085; rev:2;)
alert tcp $HOME_NET any -> 198.44.182.236 9527 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106017; rev:2;)
alert tcp $HOME_NET any -> 198.46.159.243 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105619; rev:2;)
alert tcp $HOME_NET any -> 198.46.189.155 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102643; rev:2;)
alert tcp $HOME_NET any -> 199.187.25.100 51001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104603; rev:2;)
alert tcp $HOME_NET any -> 199.187.25.100 52660 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104602; rev:2;)
alert tcp $HOME_NET any -> 202.61.73.72 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106577; rev:2;)
alert tcp $HOME_NET any -> 202.61.138.81 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105469; rev:2;)
alert tcp $HOME_NET any -> 202.61.140.122 58002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103805; rev:2;)
alert tcp $HOME_NET any -> 202.61.140.244 443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102642; rev:2;)
alert tcp $HOME_NET any -> 202.140.142.97 1111 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102641; rev:2;)
alert tcp $HOME_NET any -> 202.140.142.97 2222 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102640; rev:2;)
alert tcp $HOME_NET any -> 202.182.102.83 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102639; rev:2;)
alert tcp $HOME_NET any -> 202.182.102.83 50299 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106128; rev:2;)
alert tcp $HOME_NET any -> 203.15.7.129 1521 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102638; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 10000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102637; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 10002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102636; rev:2;)
alert tcp $HOME_NET any -> 203.91.76.75 20000 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102635; rev:2;)
alert tcp $HOME_NET any -> 203.91.77.226 8087 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102634; rev:2;)
alert tcp $HOME_NET any -> 203.91.77.226 8689 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102633; rev:2;)
alert tcp $HOME_NET any -> 204.194.51.97 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102632; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102631; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102630; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102629; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 9443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101652; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102628; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102627; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102626; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.209 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102625; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.240 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102624; rev:2;)
alert tcp $HOME_NET any -> 205.186.112.15 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102623; rev:2;)
alert tcp $HOME_NET any -> 205.186.112.15 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102622; rev:2;)
alert tcp $HOME_NET any -> 205.234.170.141 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104306; rev:2;)
alert tcp $HOME_NET any -> 205.234.170.195 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100927; rev:2;)
alert tcp $HOME_NET any -> 205.234.170.195 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100929; rev:2;)
alert tcp $HOME_NET any -> 206.119.165.12 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102621; rev:2;)
alert tcp $HOME_NET any -> 206.119.165.20 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102620; rev:2;)
alert tcp $HOME_NET any -> 206.119.165.25 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102619; rev:2;)
alert tcp $HOME_NET any -> 206.119.167.239 12899 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102618; rev:2;)
alert tcp $HOME_NET any -> 206.119.167.239 32899 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104601; rev:2;)
alert tcp $HOME_NET any -> 206.119.178.109 2080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102617; rev:2;)
alert tcp $HOME_NET any -> 206.119.178.109 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102616; rev:2;)
alert tcp $HOME_NET any -> 206.119.178.109 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102615; rev:2;)
alert tcp $HOME_NET any -> 206.119.189.208 6969 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102614; rev:2;)
alert tcp $HOME_NET any -> 206.119.189.208 7979 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104600; rev:2;)
alert tcp $HOME_NET any -> 206.119.189.208 8787 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103897; rev:2;)
alert tcp $HOME_NET any -> 206.119.189.208 8989 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102613; rev:2;)
alert tcp $HOME_NET any -> 206.188.196.221 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105622; rev:2;)
alert tcp $HOME_NET any -> 206.188.196.221 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105614; rev:2;)
alert tcp $HOME_NET any -> 206.188.196.221 8001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105867; rev:2;)
alert tcp $HOME_NET any -> 206.188.196.221 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105666; rev:2;)
alert tcp $HOME_NET any -> 206.188.196.221 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105652; rev:2;)
alert tcp $HOME_NET any -> 206.206.76.110 2082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105612; rev:2;)
alert tcp $HOME_NET any -> 206.206.76.110 2086 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105668; rev:2;)
alert tcp $HOME_NET any -> 206.206.76.110 2095 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105667; rev:2;)
alert tcp $HOME_NET any -> 206.206.127.221 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102612; rev:2;)
alert tcp $HOME_NET any -> 206.217.136.195 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102611; rev:2;)
alert tcp $HOME_NET any -> 206.217.136.195 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102610; rev:2;)
alert tcp $HOME_NET any -> 206.238.68.19 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104305; rev:2;)
alert tcp $HOME_NET any -> 206.238.68.19 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104304; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.8 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102609; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.8 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102608; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.8 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102607; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.117 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102606; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.117 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102605; rev:2;)
alert tcp $HOME_NET any -> 206.238.123.117 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102604; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.99 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102603; rev:2;)
alert tcp $HOME_NET any -> 207.56.11.49 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102602; rev:2;)
alert tcp $HOME_NET any -> 207.56.20.68 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104303; rev:2;)
alert tcp $HOME_NET any -> 207.57.121.71 9443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102601; rev:2;)
alert tcp $HOME_NET any -> 207.57.121.71 54322 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102600; rev:2;)
alert tcp $HOME_NET any -> 207.57.122.131 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104084; rev:2;)
alert tcp $HOME_NET any -> 207.57.122.131 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106813; rev:2;)
alert tcp $HOME_NET any -> 207.57.122.205 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102599; rev:2;)
alert tcp $HOME_NET any -> 207.57.128.50 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102598; rev:2;)
alert tcp $HOME_NET any -> 207.57.128.50 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102597; rev:2;)
alert tcp $HOME_NET any -> 207.90.238.77 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102596; rev:2;)
alert tcp $HOME_NET any -> 207.148.64.94 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101521; rev:2;)
alert tcp $HOME_NET any -> 207.148.74.81 62161 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102595; rev:2;)
alert tcp $HOME_NET any -> 207.148.126.156 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100928; rev:2;)
alert tcp $HOME_NET any -> 207.148.126.156 28884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101205; rev:2;)
alert tcp $HOME_NET any -> 208.87.203.33 50828 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102594; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 7771 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106295; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 9991 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106294; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 9993 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106293; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 18884 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106292; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 18889 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106392; rev:2;)
alert tcp $HOME_NET any -> 208.167.245.124 52661 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106291; rev:2;)
alert tcp $HOME_NET any -> 209.92.170.120 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102593; rev:2;)
alert tcp $HOME_NET any -> 211.101.232.65 40001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106576; rev:2;)
alert tcp $HOME_NET any -> 211.101.233.147 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102592; rev:2;)
alert tcp $HOME_NET any -> 211.101.235.94 8088 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100926; rev:2;)
alert tcp $HOME_NET any -> 211.101.244.120 1443 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104005; rev:2;)
alert tcp $HOME_NET any -> 211.159.178.25 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105672; rev:2;)
alert tcp $HOME_NET any -> 218.1.219.233 25242 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102591; rev:2;)
alert tcp $HOME_NET any -> 218.1.219.233 51055 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102590; rev:2;)
alert tcp $HOME_NET any -> 218.244.142.4 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101578; rev:2;)
alert tcp $HOME_NET any -> 219.151.144.209 12306 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105866; rev:2;)
alert tcp $HOME_NET any -> 223.113.41.56 6079 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102589; rev:2;)