# publicmosaic.rules — generated 2026-10-30 20:07 UTC — 921 rules — TLP:CLEAR
# source: https://publicmosaic.com — published for defensive use
# scope: configuration beacon type — https://publicmosaic.com/config/beacon_type/dGNw
# rev:4 — replace every earlier rule file from this site. Suricata refuses a duplicate sid, so never load an older one beside this one.
# covers listed listeners only; archived listings omitted: 0
# A withdrawal can take up to five minutes to reach this file. Each address's page under publicmosaic.com/ip/ is authoritative.
alert tcp $HOME_NET any -> 207.148.126.156 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.148.126.156; sid:9100928; rev:4;)
alert tcp $HOME_NET any -> 205.234.170.195 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.234.170.195; sid:9100929; rev:4;)
alert tcp $HOME_NET any -> 194.150.166.179 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/194.150.166.179; sid:9100931; rev:4;)
alert tcp $HOME_NET any -> 185.242.3.178 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.242.3.178; sid:9100933; rev:4;)
alert tcp $HOME_NET any -> 185.242.3.178 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.242.3.178; sid:9100935; rev:4;)
alert tcp $HOME_NET any -> 156.248.73.83 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.248.73.83; sid:9100938; rev:4;)
alert tcp $HOME_NET any -> 150.109.94.129 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/150.109.94.129; sid:9100947; rev:4;)
alert tcp $HOME_NET any -> 149.104.28.204 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.104.28.204; sid:9100948; rev:4;)
alert tcp $HOME_NET any -> 134.209.214.178 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.209.214.178; sid:9100949; rev:4;)
alert tcp $HOME_NET any -> 123.254.106.168 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/123.254.106.168; sid:9100951; rev:4;)
alert tcp $HOME_NET any -> 107.172.190.252 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.190.252; sid:9100955; rev:4;)
alert tcp $HOME_NET any -> 107.172.190.252 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.190.252; sid:9100957; rev:4;)
alert tcp $HOME_NET any -> 107.172.63.153 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.63.153; sid:9100958; rev:4;)
alert tcp $HOME_NET any -> 107.151.233.120 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.151.233.120; sid:9100961; rev:4;)
alert tcp $HOME_NET any -> 89.34.227.96 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/89.34.227.96; sid:9100963; rev:4;)
alert tcp $HOME_NET any -> 50.114.184.157 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.184.157; sid:9100971; rev:4;)
alert tcp $HOME_NET any -> 50.114.184.157 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.184.157; sid:9100973; rev:4;)
alert tcp $HOME_NET any -> 47.237.156.196 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.237.156.196; sid:9100974; rev:4;)
alert tcp $HOME_NET any -> 47.236.197.86 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.197.86; sid:9100976; rev:4;)
alert tcp $HOME_NET any -> 45.194.17.183 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.194.17.183; sid:9100982; rev:4;)
alert tcp $HOME_NET any -> 45.86.229.111 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.86.229.111; sid:9100986; rev:4;)
alert tcp $HOME_NET any -> 34.92.225.25 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/34.92.225.25; sid:9100993; rev:4;)
alert tcp $HOME_NET any -> 23.95.243.47 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.243.47; sid:9100994; rev:4;)
alert tcp $HOME_NET any -> 23.27.47.158 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.27.47.158; sid:9100996; rev:4;)
alert tcp $HOME_NET any -> 8.211.146.92 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.211.146.92; sid:9100998; rev:4;)
alert tcp $HOME_NET any -> 96.126.191.30 6080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/96.126.191.30; sid:9101004; rev:4;)
alert tcp $HOME_NET any -> 43.134.100.72 4444 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.134.100.72; sid:9101012; rev:4;)
alert tcp $HOME_NET any -> 38.55.194.135 9980 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.55.194.135; sid:9101016; rev:4;)
alert tcp $HOME_NET any -> 5.79.70.5 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/5.79.70.5; sid:9101134; rev:4;)
alert tcp $HOME_NET any -> 198.23.228.112 39001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.23.228.112; sid:9101152; rev:4;)
alert tcp $HOME_NET any -> 192.129.141.183 7777 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.129.141.183; sid:9101168; rev:4;)
alert tcp $HOME_NET any -> 154.86.30.94 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.86.30.94; sid:9101178; rev:4;)
alert tcp $HOME_NET any -> 151.243.229.224 8086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/151.243.229.224; sid:9101179; rev:4;)
alert tcp $HOME_NET any -> 150.109.94.129 6666 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/150.109.94.129; sid:9101180; rev:4;)
alert tcp $HOME_NET any -> 107.172.63.153 8885 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.63.153; sid:9101190; rev:4;)
alert tcp $HOME_NET any -> 54.183.237.74 18082 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/54.183.237.74; sid:9101199; rev:4;)
alert tcp $HOME_NET any -> 207.148.126.156 28884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.148.126.156; sid:9101205; rev:4;)
alert tcp $HOME_NET any -> 193.160.32.138 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.160.32.138; sid:9101206; rev:4;)
alert tcp $HOME_NET any -> 169.239.128.75 8082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/169.239.128.75; sid:9101209; rev:4;)
alert tcp $HOME_NET any -> 165.154.226.87 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.226.87; sid:9101210; rev:4;)
alert tcp $HOME_NET any -> 156.238.224.156 5522 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.224.156; sid:9101213; rev:4;)
alert tcp $HOME_NET any -> 150.129.80.247 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/150.129.80.247; sid:9101215; rev:4;)
alert tcp $HOME_NET any -> 104.225.238.193 10020 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.225.238.193; sid:9101219; rev:4;)
alert tcp $HOME_NET any -> 104.168.94.108 38006 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.94.108; sid:9101220; rev:4;)
alert tcp $HOME_NET any -> 118.99.55.153 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/118.99.55.153; sid:9101340; rev:4;)
alert tcp $HOME_NET any -> 102.129.165.177 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.129.165.177; sid:9101345; rev:4;)
alert tcp $HOME_NET any -> 167.179.76.179 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/167.179.76.179; sid:9101441; rev:4;)
alert tcp $HOME_NET any -> 207.148.64.94 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.148.64.94; sid:9101521; rev:4;)
alert tcp $HOME_NET any -> 154.91.180.246 18082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.180.246; sid:9101523; rev:4;)
alert tcp $HOME_NET any -> 45.221.118.139 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.118.139; sid:9101577; rev:4;)
alert tcp $HOME_NET any -> 149.104.21.33 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.104.21.33; sid:9101582; rev:4;)
alert tcp $HOME_NET any -> 104.244.91.64 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.244.91.64; sid:9101628; rev:4;)
alert tcp $HOME_NET any -> 43.254.166.35 39001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.254.166.35; sid:9101648; rev:4;)
alert tcp $HOME_NET any -> 204.194.53.9 9443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.53.9; sid:9101652; rev:4;)
alert tcp $HOME_NET any -> 82.23.246.186 8023 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.23.246.186; sid:9101995; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.34; sid:9102294; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.44; sid:9102296; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.35; sid:9102299; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.62; sid:9102301; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.61; sid:9102303; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.60 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.60; sid:9102305; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.58 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.58; sid:9102307; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.57 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.57; sid:9102309; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.55 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.55; sid:9102311; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.52 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.52; sid:9102313; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.39; sid:9102315; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.38; sid:9102317; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.37; sid:9102319; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.35; sid:9102321; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.34; sid:9102323; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.62; sid:9102325; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.55 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.55; sid:9102327; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.50 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.50; sid:9102329; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.45 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.45; sid:9102331; rev:4;)
alert tcp $HOME_NET any -> 154.62.226.131 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.62.226.131; sid:9102335; rev:4;)
alert tcp $HOME_NET any -> 154.31.217.202 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.31.217.202; sid:9102338; rev:4;)
alert tcp $HOME_NET any -> 154.31.217.202 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.31.217.202; sid:9102339; rev:4;)
alert tcp $HOME_NET any -> 154.31.216.202 29000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.31.216.202; sid:9102340; rev:4;)
alert tcp $HOME_NET any -> 154.31.216.202 9290 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.31.216.202; sid:9102341; rev:4;)
alert tcp $HOME_NET any -> 154.12.92.28 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.12.92.28; sid:9102342; rev:4;)
alert tcp $HOME_NET any -> 153.75.224.136 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/153.75.224.136; sid:9102343; rev:4;)
alert tcp $HOME_NET any -> 152.67.33.246 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/152.67.33.246; sid:9102349; rev:4;)
alert tcp $HOME_NET any -> 152.32.210.65 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/152.32.210.65; sid:9102352; rev:4;)
alert tcp $HOME_NET any -> 152.32.201.214 25992 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/152.32.201.214; sid:9102353; rev:4;)
alert tcp $HOME_NET any -> 152.32.201.214 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/152.32.201.214; sid:9102354; rev:4;)
alert tcp $HOME_NET any -> 150.230.62.206 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/150.230.62.206; sid:9102360; rev:4;)
alert tcp $HOME_NET any -> 149.248.76.53 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.248.76.53; sid:9102361; rev:4;)
alert tcp $HOME_NET any -> 149.88.73.99 2222 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.88.73.99; sid:9102362; rev:4;)
alert tcp $HOME_NET any -> 149.30.247.60 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.30.247.60; sid:9102363; rev:4;)
alert tcp $HOME_NET any -> 149.28.132.51 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.132.51; sid:9102367; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 56435 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9102368; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9102369; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 56435 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9102370; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9102371; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9102372; rev:4;)
alert tcp $HOME_NET any -> 144.202.26.27 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/144.202.26.27; sid:9102374; rev:4;)
alert tcp $HOME_NET any -> 143.92.51.145 18083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/143.92.51.145; sid:9102375; rev:4;)
alert tcp $HOME_NET any -> 143.92.51.145 18082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/143.92.51.145; sid:9102376; rev:4;)
alert tcp $HOME_NET any -> 143.92.51.145 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/143.92.51.145; sid:9102377; rev:4;)
alert tcp $HOME_NET any -> 142.4.58.48 1224 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/142.4.58.48; sid:9102378; rev:4;)
alert tcp $HOME_NET any -> 142.4.58.48 1223 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/142.4.58.48; sid:9102379; rev:4;)
alert tcp $HOME_NET any -> 139.180.222.237 8321 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.222.237; sid:9102381; rev:4;)
alert tcp $HOME_NET any -> 139.180.222.237 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.222.237; sid:9102382; rev:4;)
alert tcp $HOME_NET any -> 139.180.219.233 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.219.233; sid:9102383; rev:4;)
alert tcp $HOME_NET any -> 139.180.128.42 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.128.42; sid:9102384; rev:4;)
alert tcp $HOME_NET any -> 137.220.251.124 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/137.220.251.124; sid:9102389; rev:4;)
alert tcp $HOME_NET any -> 137.220.199.216 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/137.220.199.216; sid:9102390; rev:4;)
alert tcp $HOME_NET any -> 132.226.72.148 10000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/132.226.72.148; sid:9102393; rev:4;)
alert tcp $HOME_NET any -> 130.94.92.169 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.92.169; sid:9102395; rev:4;)
alert tcp $HOME_NET any -> 130.94.33.140 4433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.33.140; sid:9102396; rev:4;)
alert tcp $HOME_NET any -> 130.94.30.168 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.30.168; sid:9102397; rev:4;)
alert tcp $HOME_NET any -> 130.94.30.168 53 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.30.168; sid:9102398; rev:4;)
alert tcp $HOME_NET any -> 122.10.52.27 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.52.27; sid:9102422; rev:4;)
alert tcp $HOME_NET any -> 122.10.24.92 8007 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.24.92; sid:9102423; rev:4;)
alert tcp $HOME_NET any -> 122.10.24.92 8003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.24.92; sid:9102424; rev:4;)
alert tcp $HOME_NET any -> 122.10.24.92 808 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.24.92; sid:9102425; rev:4;)
alert tcp $HOME_NET any -> 122.10.5.218 8007 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.5.218; sid:9102426; rev:4;)
alert tcp $HOME_NET any -> 122.10.5.218 808 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.5.218; sid:9102427; rev:4;)
alert tcp $HOME_NET any -> 110.173.53.99 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/110.173.53.99; sid:9102486; rev:4;)
alert tcp $HOME_NET any -> 108.160.138.37 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/108.160.138.37; sid:9102494; rev:4;)
alert tcp $HOME_NET any -> 107.174.92.241 15672 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.174.92.241; sid:9102498; rev:4;)
alert tcp $HOME_NET any -> 107.173.101.114 10000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.101.114; sid:9102499; rev:4;)
alert tcp $HOME_NET any -> 107.173.21.218 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.21.218; sid:9102501; rev:4;)
alert tcp $HOME_NET any -> 107.173.13.251 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.13.251; sid:9102502; rev:4;)
alert tcp $HOME_NET any -> 107.172.255.93 18989 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.255.93; sid:9102503; rev:4;)
alert tcp $HOME_NET any -> 107.172.255.93 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.255.93; sid:9102504; rev:4;)
alert tcp $HOME_NET any -> 107.172.190.252 65530 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.190.252; sid:9102506; rev:4;)
alert tcp $HOME_NET any -> 107.161.168.217 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.161.168.217; sid:9102508; rev:4;)
alert tcp $HOME_NET any -> 104.233.154.139 888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.233.154.139; sid:9102524; rev:4;)
alert tcp $HOME_NET any -> 104.192.80.76 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.192.80.76; sid:9102526; rev:4;)
alert tcp $HOME_NET any -> 104.168.109.192 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.109.192; sid:9102527; rev:4;)
alert tcp $HOME_NET any -> 104.168.94.108 38002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.94.108; sid:9102528; rev:4;)
alert tcp $HOME_NET any -> 104.168.94.108 38001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.94.108; sid:9102529; rev:4;)
alert tcp $HOME_NET any -> 104.168.22.209 53 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.22.209; sid:9102530; rev:4;)
alert tcp $HOME_NET any -> 103.193.172.6 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.193.172.6; sid:9102534; rev:4;)
alert tcp $HOME_NET any -> 103.159.206.136 60024 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.159.206.136; sid:9102535; rev:4;)
alert tcp $HOME_NET any -> 103.159.206.136 10024 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.159.206.136; sid:9102536; rev:4;)
alert tcp $HOME_NET any -> 103.153.36.86 20001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.153.36.86; sid:9102538; rev:4;)
alert tcp $HOME_NET any -> 103.153.36.86 20000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.153.36.86; sid:9102539; rev:4;)
alert tcp $HOME_NET any -> 103.136.150.98 60337 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.136.150.98; sid:9102540; rev:4;)
alert tcp $HOME_NET any -> 103.136.150.98 60336 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.136.150.98; sid:9102541; rev:4;)
alert tcp $HOME_NET any -> 103.136.150.98 60335 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.136.150.98; sid:9102542; rev:4;)
alert tcp $HOME_NET any -> 103.136.150.98 60334 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.136.150.98; sid:9102543; rev:4;)
alert tcp $HOME_NET any -> 103.123.18.29 32696 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.123.18.29; sid:9102544; rev:4;)
alert tcp $HOME_NET any -> 103.118.247.231 50841 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.118.247.231; sid:9102545; rev:4;)
alert tcp $HOME_NET any -> 103.115.64.31 8808 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.115.64.31; sid:9102546; rev:4;)
alert tcp $HOME_NET any -> 103.113.158.11 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.113.158.11; sid:9102547; rev:4;)
alert tcp $HOME_NET any -> 103.97.177.92 10089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.97.177.92; sid:9102549; rev:4;)
alert tcp $HOME_NET any -> 103.75.190.47 49152 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.75.190.47; sid:9102551; rev:4;)
alert tcp $HOME_NET any -> 103.75.190.47 7788 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.75.190.47; sid:9102552; rev:4;)
alert tcp $HOME_NET any -> 103.42.214.19 15667 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.42.214.19; sid:9102555; rev:4;)
alert tcp $HOME_NET any -> 102.209.117.153 8000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.209.117.153; sid:9102556; rev:4;)
alert tcp $HOME_NET any -> 102.134.54.230 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.134.54.230; sid:9102559; rev:4;)
alert tcp $HOME_NET any -> 102.134.54.230 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.134.54.230; sid:9102560; rev:4;)
alert tcp $HOME_NET any -> 101.33.45.136 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/101.33.45.136; sid:9102572; rev:4;)
alert tcp $HOME_NET any -> 101.32.241.197 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/101.32.241.197; sid:9102573; rev:4;)
alert tcp $HOME_NET any -> 13.236.190.6 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.236.190.6; sid:9102574; rev:4;)
alert tcp $HOME_NET any -> 13.231.27.88 56767 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.231.27.88; sid:9102575; rev:4;)
alert tcp $HOME_NET any -> 13.212.206.34 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.212.206.34; sid:9102576; rev:4;)
alert tcp $HOME_NET any -> 13.212.111.223 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.212.111.223; sid:9102577; rev:4;)
alert tcp $HOME_NET any -> 13.210.13.81 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.210.13.81; sid:9102578; rev:4;)
alert tcp $HOME_NET any -> 13.204.0.27 8089 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/13.204.0.27; sid:9102579; rev:4;)
alert tcp $HOME_NET any -> 209.92.170.120 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/209.92.170.120; sid:9102593; rev:4;)
alert tcp $HOME_NET any -> 208.87.203.33 50828 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.87.203.33; sid:9102594; rev:4;)
alert tcp $HOME_NET any -> 207.148.74.81 62161 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.148.74.81; sid:9102595; rev:4;)
alert tcp $HOME_NET any -> 207.90.238.77 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.90.238.77; sid:9102596; rev:4;)
alert tcp $HOME_NET any -> 207.57.128.50 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.128.50; sid:9102597; rev:4;)
alert tcp $HOME_NET any -> 207.57.128.50 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.128.50; sid:9102598; rev:4;)
alert tcp $HOME_NET any -> 207.57.122.205 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.122.205; sid:9102599; rev:4;)
alert tcp $HOME_NET any -> 207.57.121.71 54322 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.121.71; sid:9102600; rev:4;)
alert tcp $HOME_NET any -> 207.57.121.71 9443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.121.71; sid:9102601; rev:4;)
alert tcp $HOME_NET any -> 207.56.11.49 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.56.11.49; sid:9102602; rev:4;)
alert tcp $HOME_NET any -> 207.56.7.99 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.56.7.99; sid:9102603; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.117 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.117; sid:9102604; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.117 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.117; sid:9102605; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.117 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.117; sid:9102606; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.8 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.8; sid:9102607; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.8 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.8; sid:9102608; rev:4;)
alert tcp $HOME_NET any -> 206.238.123.8 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.123.8; sid:9102609; rev:4;)
alert tcp $HOME_NET any -> 206.217.136.195 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.217.136.195; sid:9102610; rev:4;)
alert tcp $HOME_NET any -> 206.217.136.195 53 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.217.136.195; sid:9102611; rev:4;)
alert tcp $HOME_NET any -> 206.206.127.221 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.206.127.221; sid:9102612; rev:4;)
alert tcp $HOME_NET any -> 206.119.189.208 8989 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.189.208; sid:9102613; rev:4;)
alert tcp $HOME_NET any -> 206.119.189.208 6969 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.189.208; sid:9102614; rev:4;)
alert tcp $HOME_NET any -> 206.119.178.109 2082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.178.109; sid:9102616; rev:4;)
alert tcp $HOME_NET any -> 206.119.178.109 2080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.178.109; sid:9102617; rev:4;)
alert tcp $HOME_NET any -> 206.119.167.239 12899 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.167.239; sid:9102618; rev:4;)
alert tcp $HOME_NET any -> 206.119.165.25 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.165.25; sid:9102619; rev:4;)
alert tcp $HOME_NET any -> 206.119.165.20 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.165.20; sid:9102620; rev:4;)
alert tcp $HOME_NET any -> 206.119.165.12 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.165.12; sid:9102621; rev:4;)
alert tcp $HOME_NET any -> 205.186.112.15 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.186.112.15; sid:9102622; rev:4;)
alert tcp $HOME_NET any -> 205.186.112.15 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.186.112.15; sid:9102623; rev:4;)
alert tcp $HOME_NET any -> 204.194.54.240 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.54.240; sid:9102624; rev:4;)
alert tcp $HOME_NET any -> 204.194.54.209 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.54.209; sid:9102625; rev:4;)
alert tcp $HOME_NET any -> 204.194.54.54 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.54.54; sid:9102627; rev:4;)
alert tcp $HOME_NET any -> 204.194.54.54 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.54.54; sid:9102628; rev:4;)
alert tcp $HOME_NET any -> 204.194.53.9 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.53.9; sid:9102630; rev:4;)
alert tcp $HOME_NET any -> 204.194.53.9 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/204.194.53.9; sid:9102631; rev:4;)
alert tcp $HOME_NET any -> 203.91.77.226 8689 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/203.91.77.226; sid:9102633; rev:4;)
alert tcp $HOME_NET any -> 203.91.77.226 8087 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/203.91.77.226; sid:9102634; rev:4;)
alert tcp $HOME_NET any -> 203.91.76.75 20000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/203.91.76.75; sid:9102635; rev:4;)
alert tcp $HOME_NET any -> 203.91.76.75 10002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/203.91.76.75; sid:9102636; rev:4;)
alert tcp $HOME_NET any -> 203.91.76.75 10000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/203.91.76.75; sid:9102637; rev:4;)
alert tcp $HOME_NET any -> 198.46.189.155 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.46.189.155; sid:9102643; rev:4;)
alert tcp $HOME_NET any -> 198.44.46.122 6666 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.44.46.122; sid:9102644; rev:4;)
alert tcp $HOME_NET any -> 194.26.73.23 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/194.26.73.23; sid:9102646; rev:4;)
alert tcp $HOME_NET any -> 193.149.190.66 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.149.190.66; sid:9102647; rev:4;)
alert tcp $HOME_NET any -> 192.255.128.122 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.255.128.122; sid:9102651; rev:4;)
alert tcp $HOME_NET any -> 192.243.120.239 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.243.120.239; sid:9102653; rev:4;)
alert tcp $HOME_NET any -> 192.236.223.240 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.236.223.240; sid:9102654; rev:4;)
alert tcp $HOME_NET any -> 192.129.141.183 9999 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.129.141.183; sid:9102665; rev:4;)
alert tcp $HOME_NET any -> 192.3.98.166 55555 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.3.98.166; sid:9102667; rev:4;)
alert tcp $HOME_NET any -> 188.119.65.98 8004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/188.119.65.98; sid:9102668; rev:4;)
alert tcp $HOME_NET any -> 186.241.68.124 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/186.241.68.124; sid:9102669; rev:4;)
alert tcp $HOME_NET any -> 185.244.212.122 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.244.212.122; sid:9102671; rev:4;)
alert tcp $HOME_NET any -> 178.16.53.91 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.53.91; sid:9102689; rev:4;)
alert tcp $HOME_NET any -> 178.16.53.91 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.53.91; sid:9102690; rev:4;)
alert tcp $HOME_NET any -> 178.16.53.91 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.53.91; sid:9102691; rev:4;)
alert tcp $HOME_NET any -> 172.233.87.220 9100 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.233.87.220; sid:9102697; rev:4;)
alert tcp $HOME_NET any -> 167.71.203.78 47363 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/167.71.203.78; sid:9102699; rev:4;)
alert tcp $HOME_NET any -> 167.17.47.58 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/167.17.47.58; sid:9102700; rev:4;)
alert tcp $HOME_NET any -> 165.154.205.178 21480 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.205.178; sid:9102702; rev:4;)
alert tcp $HOME_NET any -> 165.154.132.203 443 (msg:"Public Mosaic malware distribution host Sliver"; reference:url,publicmosaic.com/ip/165.154.132.203; sid:9102703; rev:4;)
alert tcp $HOME_NET any -> 165.154.45.137 65533 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.45.137; sid:9102704; rev:4;)
alert tcp $HOME_NET any -> 165.154.6.188 1389 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.6.188; sid:9102705; rev:4;)
alert tcp $HOME_NET any -> 156.248.73.84 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.248.73.84; sid:9102715; rev:4;)
alert tcp $HOME_NET any -> 156.248.73.84 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.248.73.84; sid:9102716; rev:4;)
alert tcp $HOME_NET any -> 156.248.73.82 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.248.73.82; sid:9102717; rev:4;)
alert tcp $HOME_NET any -> 156.248.73.82 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.248.73.82; sid:9102718; rev:4;)
alert tcp $HOME_NET any -> 156.244.9.19 9090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.244.9.19; sid:9102720; rev:4;)
alert tcp $HOME_NET any -> 156.238.237.103 801 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.237.103; sid:9102721; rev:4;)
alert tcp $HOME_NET any -> 156.238.237.103 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.237.103; sid:9102722; rev:4;)
alert tcp $HOME_NET any -> 156.238.237.103 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.237.103; sid:9102723; rev:4;)
alert tcp $HOME_NET any -> 156.238.122.188 8801 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.122.188; sid:9102724; rev:4;)
alert tcp $HOME_NET any -> 155.117.224.68 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/155.117.224.68; sid:9102726; rev:4;)
alert tcp $HOME_NET any -> 154.91.180.61 53 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.180.61; sid:9102729; rev:4;)
alert tcp $HOME_NET any -> 154.89.195.170 33060 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.89.195.170; sid:9102730; rev:4;)
alert tcp $HOME_NET any -> 154.89.152.200 3306 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.89.152.200; sid:9102731; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.60 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.60; sid:9102733; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.57 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.57; sid:9102735; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.55 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.55; sid:9102737; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.61; sid:9102739; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.59; sid:9102741; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.58 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.58; sid:9102743; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.57 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.57; sid:9102745; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.56 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.56; sid:9102747; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.48 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.48; sid:9102748; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.55 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.55; sid:9102749; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.51 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.51; sid:9102752; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.33 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.33; sid:9102754; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.47; sid:9102755; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.46 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.46; sid:9102759; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.54 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.54; sid:9102760; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.49 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.49; sid:9102763; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.38; sid:9102765; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.37; sid:9102768; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.51 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.51; sid:9102770; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.53 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.53; sid:9102771; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.47; sid:9102773; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.44; sid:9102775; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.40 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.40; sid:9102777; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.61; sid:9102778; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.47; sid:9102780; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.39; sid:9102782; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.43 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.43; sid:9102784; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.34; sid:9102792; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.60 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.60; sid:9102793; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.54 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.54; sid:9102795; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.48 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.48; sid:9102796; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.45 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.45; sid:9102797; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.42; sid:9102798; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.43 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.43; sid:9102800; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.42; sid:9102801; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.62; sid:9102803; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.59; sid:9102805; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.56 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.56; sid:9102809; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.54 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.54; sid:9102811; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.51 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.51; sid:9102813; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.48 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.48; sid:9102816; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.47; sid:9102817; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.46 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.46; sid:9102819; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.44; sid:9102822; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.43 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.43; sid:9102823; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.42; sid:9102825; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.37; sid:9102827; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.36; sid:9102829; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.35; sid:9102831; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.33 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.33; sid:9102834; rev:4;)
alert tcp $HOME_NET any -> 95.182.86.106 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/95.182.86.106; sid:9102898; rev:4;)
alert tcp $HOME_NET any -> 93.177.77.228 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/93.177.77.228; sid:9102899; rev:4;)
alert tcp $HOME_NET any -> 91.213.186.177 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.213.186.177; sid:9102901; rev:4;)
alert tcp $HOME_NET any -> 91.92.242.3 7171 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.92.242.3; sid:9102902; rev:4;)
alert tcp $HOME_NET any -> 91.92.242.3 7002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/91.92.242.3; sid:9102903; rev:4;)
alert tcp $HOME_NET any -> 88.218.76.201 8889 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/88.218.76.201; sid:9102906; rev:4;)
alert tcp $HOME_NET any -> 85.121.245.52 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/85.121.245.52; sid:9102912; rev:4;)
alert tcp $HOME_NET any -> 82.40.42.193 8880 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.40.42.193; sid:9102920; rev:4;)
alert tcp $HOME_NET any -> 82.40.42.193 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.40.42.193; sid:9102921; rev:4;)
alert tcp $HOME_NET any -> 78.13.60.90 15000 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/78.13.60.90; sid:9102924; rev:4;)
alert tcp $HOME_NET any -> 77.73.14.175 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/77.73.14.175; sid:9102926; rev:4;)
alert tcp $HOME_NET any -> 69.48.229.177 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/69.48.229.177; sid:9102927; rev:4;)
alert tcp $HOME_NET any -> 66.59.199.82 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.59.199.82; sid:9102930; rev:4;)
alert tcp $HOME_NET any -> 65.49.233.42 3306 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/65.49.233.42; sid:9102931; rev:4;)
alert tcp $HOME_NET any -> 65.20.91.137 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/65.20.91.137; sid:9102932; rev:4;)
alert tcp $HOME_NET any -> 65.20.91.137 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/65.20.91.137; sid:9102933; rev:4;)
alert tcp $HOME_NET any -> 64.111.93.243 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.111.93.243; sid:9102935; rev:4;)
alert tcp $HOME_NET any -> 64.83.33.237 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.83.33.237; sid:9102937; rev:4;)
alert tcp $HOME_NET any -> 64.81.114.71 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.81.114.71; sid:9102938; rev:4;)
alert tcp $HOME_NET any -> 64.7.199.177 10443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.7.199.177; sid:9102939; rev:4;)
alert tcp $HOME_NET any -> 61.110.5.174 33061 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/61.110.5.174; sid:9102943; rev:4;)
alert tcp $HOME_NET any -> 61.110.5.174 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/61.110.5.174; sid:9102944; rev:4;)
alert tcp $HOME_NET any -> 54.180.100.54 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/54.180.100.54; sid:9102957; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.238 9191 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.238; sid:9102958; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.238 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.238; sid:9102959; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.238 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.238; sid:9102960; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.237 9191 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.237; sid:9102961; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.237 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.237; sid:9102963; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.237 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.237; sid:9102964; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.236 9191 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.236; sid:9102965; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.236 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.236; sid:9102967; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.236 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.236; sid:9102968; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.235 9191 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.235; sid:9102969; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.235 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.235; sid:9102971; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.234 9191 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.234; sid:9102972; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.234 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.234; sid:9102974; rev:4;)
alert tcp $HOME_NET any -> 50.114.184.157 9091 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.184.157; sid:9102975; rev:4;)
alert tcp $HOME_NET any -> 49.51.230.17 9898 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/49.51.230.17; sid:9102991; rev:4;)
alert tcp $HOME_NET any -> 49.51.230.17 9001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/49.51.230.17; sid:9102992; rev:4;)
alert tcp $HOME_NET any -> 47.243.177.251 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.243.177.251; sid:9102999; rev:4;)
alert tcp $HOME_NET any -> 47.239.223.39 8123 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.239.223.39; sid:9103000; rev:4;)
alert tcp $HOME_NET any -> 47.238.7.198 4444 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.238.7.198; sid:9103002; rev:4;)
alert tcp $HOME_NET any -> 47.237.68.187 40801 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.237.68.187; sid:9103003; rev:4;)
alert tcp $HOME_NET any -> 47.236.204.56 3695 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.204.56; sid:9103004; rev:4;)
alert tcp $HOME_NET any -> 47.236.130.154 58357 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.236.130.154; sid:9103005; rev:4;)
alert tcp $HOME_NET any -> 47.129.155.127 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/47.129.155.127; sid:9103007; rev:4;)
alert tcp $HOME_NET any -> 47.129.3.232 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/47.129.3.232; sid:9103009; rev:4;)
alert tcp $HOME_NET any -> 47.80.57.141 8889 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.80.57.141; sid:9103051; rev:4;)
alert tcp $HOME_NET any -> 47.80.57.141 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.80.57.141; sid:9103052; rev:4;)
alert tcp $HOME_NET any -> 47.79.123.84 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.79.123.84; sid:9103054; rev:4;)
alert tcp $HOME_NET any -> 47.76.37.50 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.76.37.50; sid:9103056; rev:4;)
alert tcp $HOME_NET any -> 46.28.69.174 6380 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/46.28.69.174; sid:9103057; rev:4;)
alert tcp $HOME_NET any -> 46.28.69.174 5433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/46.28.69.174; sid:9103058; rev:4;)
alert tcp $HOME_NET any -> 46.28.69.174 444 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/46.28.69.174; sid:9103059; rev:4;)
alert tcp $HOME_NET any -> 46.28.69.174 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/46.28.69.174; sid:9103060; rev:4;)
alert tcp $HOME_NET any -> 45.221.115.160 1433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.115.160; sid:9103061; rev:4;)
alert tcp $HOME_NET any -> 45.221.115.76 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.221.115.76; sid:9103062; rev:4;)
alert tcp $HOME_NET any -> 45.207.194.79 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.207.194.79; sid:9103063; rev:4;)
alert tcp $HOME_NET any -> 45.197.36.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.197.36.34; sid:9103068; rev:4;)
alert tcp $HOME_NET any -> 45.194.21.64 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.194.21.64; sid:9103070; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.15 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.15; sid:9103071; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.15 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.15; sid:9103072; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.11 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.11; sid:9103073; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.11 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.11; sid:9103074; rev:4;)
alert tcp $HOME_NET any -> 45.150.64.117 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.150.64.117; sid:9103075; rev:4;)
alert tcp $HOME_NET any -> 45.142.127.204 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.142.127.204; sid:9103076; rev:4;)
alert tcp $HOME_NET any -> 45.136.14.91 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.136.14.91; sid:9103077; rev:4;)
alert tcp $HOME_NET any -> 45.136.14.91 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.136.14.91; sid:9103079; rev:4;)
alert tcp $HOME_NET any -> 45.130.147.57 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.130.147.57; sid:9103082; rev:4;)
alert tcp $HOME_NET any -> 45.115.124.44 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.115.124.44; sid:9103083; rev:4;)
alert tcp $HOME_NET any -> 45.115.124.44 1433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.115.124.44; sid:9103084; rev:4;)
alert tcp $HOME_NET any -> 45.115.124.42 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.115.124.42; sid:9103085; rev:4;)
alert tcp $HOME_NET any -> 45.115.124.42 1433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.115.124.42; sid:9103086; rev:4;)
alert tcp $HOME_NET any -> 45.90.58.202 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.90.58.202; sid:9103087; rev:4;)
alert tcp $HOME_NET any -> 45.77.220.145 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.220.145; sid:9103090; rev:4;)
alert tcp $HOME_NET any -> 45.77.26.165 33454 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.26.165; sid:9103092; rev:4;)
alert tcp $HOME_NET any -> 45.77.26.165 4444 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.26.165; sid:9103093; rev:4;)
alert tcp $HOME_NET any -> 45.76.185.115 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.185.115; sid:9103094; rev:4;)
alert tcp $HOME_NET any -> 45.76.99.126 18080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.99.126; sid:9103095; rev:4;)
alert tcp $HOME_NET any -> 45.76.99.126 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.99.126; sid:9103096; rev:4;)
alert tcp $HOME_NET any -> 43.247.135.106 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.247.135.106; sid:9103100; rev:4;)
alert tcp $HOME_NET any -> 43.247.135.106 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.247.135.106; sid:9103101; rev:4;)
alert tcp $HOME_NET any -> 43.245.199.155 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.245.199.155; sid:9103102; rev:4;)
alert tcp $HOME_NET any -> 43.165.168.164 4455 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.165.168.164; sid:9103104; rev:4;)
alert tcp $HOME_NET any -> 43.154.134.124 9999 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.154.134.124; sid:9103108; rev:4;)
alert tcp $HOME_NET any -> 43.154.86.87 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.154.86.87; sid:9103109; rev:4;)
alert tcp $HOME_NET any -> 43.130.69.135 18083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.130.69.135; sid:9103131; rev:4;)
alert tcp $HOME_NET any -> 43.128.130.45 56502 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.128.130.45; sid:9103132; rev:4;)
alert tcp $HOME_NET any -> 43.111.235.219 16667 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.111.235.219; sid:9103133; rev:4;)
alert tcp $HOME_NET any -> 43.110.42.102 81 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.110.42.102; sid:9103135; rev:4;)
alert tcp $HOME_NET any -> 38.190.198.30 18080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.190.198.30; sid:9103166; rev:4;)
alert tcp $HOME_NET any -> 38.147.170.102 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.147.170.102; sid:9103170; rev:4;)
alert tcp $HOME_NET any -> 38.147.164.81 13389 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.147.164.81; sid:9103171; rev:4;)
alert tcp $HOME_NET any -> 38.76.201.200 33333 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.76.201.200; sid:9103172; rev:4;)
alert tcp $HOME_NET any -> 38.60.242.230 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.242.230; sid:9103174; rev:4;)
alert tcp $HOME_NET any -> 38.60.242.230 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.242.230; sid:9103175; rev:4;)
alert tcp $HOME_NET any -> 38.60.241.251 4443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.241.251; sid:9103176; rev:4;)
alert tcp $HOME_NET any -> 38.60.241.251 1443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.241.251; sid:9103177; rev:4;)
alert tcp $HOME_NET any -> 38.60.241.251 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.241.251; sid:9103178; rev:4;)
alert tcp $HOME_NET any -> 38.60.125.131 888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.125.131; sid:9103179; rev:4;)
alert tcp $HOME_NET any -> 38.55.107.19 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.55.107.19; sid:9103181; rev:4;)
alert tcp $HOME_NET any -> 38.54.95.136 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.95.136; sid:9103182; rev:4;)
alert tcp $HOME_NET any -> 38.54.95.51 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.95.51; sid:9103184; rev:4;)
alert tcp $HOME_NET any -> 38.54.63.84 9988 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.63.84; sid:9103185; rev:4;)
alert tcp $HOME_NET any -> 38.54.40.184 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.40.184; sid:9103186; rev:4;)
alert tcp $HOME_NET any -> 38.54.13.44 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.13.44; sid:9103187; rev:4;)
alert tcp $HOME_NET any -> 38.54.1.21 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.1.21; sid:9103188; rev:4;)
alert tcp $HOME_NET any -> 38.47.221.12 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.47.221.12; sid:9103189; rev:4;)
alert tcp $HOME_NET any -> 38.47.213.14 4433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.47.213.14; sid:9103190; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.204 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.204; sid:9103191; rev:4;)
alert tcp $HOME_NET any -> 34.243.36.28 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/34.243.36.28; sid:9103199; rev:4;)
alert tcp $HOME_NET any -> 23.254.219.25 8011 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.219.25; sid:9103206; rev:4;)
alert tcp $HOME_NET any -> 23.254.208.236 9895 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.208.236; sid:9103207; rev:4;)
alert tcp $HOME_NET any -> 23.254.208.236 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.208.236; sid:9103208; rev:4;)
alert tcp $HOME_NET any -> 23.254.174.175 8005 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.174.175; sid:9103209; rev:4;)
alert tcp $HOME_NET any -> 23.252.123.26 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.252.123.26; sid:9103210; rev:4;)
alert tcp $HOME_NET any -> 23.238.28.180 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.238.28.180; sid:9103211; rev:4;)
alert tcp $HOME_NET any -> 23.225.71.207 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.225.71.207; sid:9103212; rev:4;)
alert tcp $HOME_NET any -> 23.95.242.55 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.242.55; sid:9103220; rev:4;)
alert tcp $HOME_NET any -> 23.95.48.221 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.48.221; sid:9103223; rev:4;)
alert tcp $HOME_NET any -> 23.95.48.221 81 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.48.221; sid:9103224; rev:4;)
alert tcp $HOME_NET any -> 23.94.70.197 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.70.197; sid:9103226; rev:4;)
alert tcp $HOME_NET any -> 23.94.23.151 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.23.151; sid:9103227; rev:4;)
alert tcp $HOME_NET any -> 23.27.51.31 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.27.51.31; sid:9103228; rev:4;)
alert tcp $HOME_NET any -> 20.189.122.18 44446 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/20.189.122.18; sid:9103229; rev:4;)
alert tcp $HOME_NET any -> 18.179.119.184 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.179.119.184; sid:9103230; rev:4;)
alert tcp $HOME_NET any -> 18.178.31.87 65514 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.178.31.87; sid:9103231; rev:4;)
alert tcp $HOME_NET any -> 8.219.208.193 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.208.193; sid:9103234; rev:4;)
alert tcp $HOME_NET any -> 8.219.208.193 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.208.193; sid:9103235; rev:4;)
alert tcp $HOME_NET any -> 8.219.90.249 8848 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.90.249; sid:9103236; rev:4;)
alert tcp $HOME_NET any -> 8.219.90.249 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.90.249; sid:9103237; rev:4;)
alert tcp $HOME_NET any -> 8.218.138.77 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.138.77; sid:9103238; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 53000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103240; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 45000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103241; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 39000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103242; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 35000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103243; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103244; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 5900 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103245; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103246; rev:4;)
alert tcp $HOME_NET any -> 8.218.114.253 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.114.253; sid:9103247; rev:4;)
alert tcp $HOME_NET any -> 8.218.82.170 18090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.218.82.170; sid:9103248; rev:4;)
alert tcp $HOME_NET any -> 8.210.131.228 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.210.131.228; sid:9103250; rev:4;)
alert tcp $HOME_NET any -> 5.181.77.115 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/5.181.77.115; sid:9103290; rev:4;)
alert tcp $HOME_NET any -> 5.161.188.204 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/5.161.188.204; sid:9103291; rev:4;)
alert tcp $HOME_NET any -> 130.94.17.70 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.17.70; sid:9103318; rev:4;)
alert tcp $HOME_NET any -> 154.89.152.34 20145 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.89.152.34; sid:9103372; rev:4;)
alert tcp $HOME_NET any -> 192.3.211.176 19999 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.3.211.176; sid:9103472; rev:4;)
alert tcp $HOME_NET any -> 182.255.89.106 10421 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/182.255.89.106; sid:9103473; rev:4;)
alert tcp $HOME_NET any -> 173.249.24.135 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.249.24.135; sid:9103476; rev:4;)
alert tcp $HOME_NET any -> 173.211.46.220 56379 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.211.46.220; sid:9103478; rev:4;)
alert tcp $HOME_NET any -> 170.205.31.53 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/170.205.31.53; sid:9103481; rev:4;)
alert tcp $HOME_NET any -> 170.106.188.119 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/170.106.188.119; sid:9103482; rev:4;)
alert tcp $HOME_NET any -> 167.160.191.220 10008 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/167.160.191.220; sid:9103483; rev:4;)
alert tcp $HOME_NET any -> 166.88.209.196 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.88.209.196; sid:9103484; rev:4;)
alert tcp $HOME_NET any -> 166.88.209.196 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.88.209.196; sid:9103485; rev:4;)
alert tcp $HOME_NET any -> 166.88.90.53 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.88.90.53; sid:9103486; rev:4;)
alert tcp $HOME_NET any -> 166.0.27.224 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.0.27.224; sid:9103487; rev:4;)
alert tcp $HOME_NET any -> 156.238.224.156 5533 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.224.156; sid:9103492; rev:4;)
alert tcp $HOME_NET any -> 154.223.16.184 4388 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.223.16.184; sid:9103493; rev:4;)
alert tcp $HOME_NET any -> 154.217.234.104 8991 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.217.234.104; sid:9103494; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8584 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9103495; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8489 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9103496; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9103497; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9103498; rev:4;)
alert tcp $HOME_NET any -> 154.206.99.60 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.206.99.60; sid:9103499; rev:4;)
alert tcp $HOME_NET any -> 154.206.98.85 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.206.98.85; sid:9103500; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.62; sid:9103502; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.59; sid:9103504; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.58 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.58; sid:9103506; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.52 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.52; sid:9103508; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.50 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.50; sid:9103510; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.48 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.48; sid:9103512; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.47; sid:9103514; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.44; sid:9103516; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.40 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.40; sid:9103518; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.37; sid:9103520; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.36; sid:9103522; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.35; sid:9103524; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.62; sid:9103526; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.61; sid:9103528; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.59; sid:9103530; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.57 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.57; sid:9103532; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.54 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.54; sid:9103534; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.53 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.53; sid:9103536; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.52 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.52; sid:9103538; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.48 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.48; sid:9103541; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.44; sid:9103542; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.43 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.43; sid:9103544; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.39; sid:9103546; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.38; sid:9103548; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.34; sid:9103550; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.33 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.33; sid:9103552; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.59; sid:9103554; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.53 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.53; sid:9103556; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.49 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.49; sid:9103558; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.45 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.45; sid:9103560; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.44 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.44; sid:9103562; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.43 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.43; sid:9103564; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.41 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.41; sid:9103566; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.38; sid:9103568; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.37; sid:9103570; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.36; sid:9103571; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.62 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.62; sid:9103574; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.61; sid:9103576; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.60 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.60; sid:9103578; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.55 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.55; sid:9103580; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.53 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.53; sid:9103581; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.52 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.52; sid:9103583; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.51 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.51; sid:9103585; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.49 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.49; sid:9103587; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.47; sid:9103589; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.45 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.45; sid:9103592; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.42; sid:9103594; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.39; sid:9103596; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.38; sid:9103598; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.36; sid:9103601; rev:4;)
alert tcp $HOME_NET any -> 107.173.10.187 58082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.10.187; sid:9103613; rev:4;)
alert tcp $HOME_NET any -> 192.236.151.33 65530 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.236.151.33; sid:9103614; rev:4;)
alert tcp $HOME_NET any -> 18.139.222.223 81 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.139.222.223; sid:9103624; rev:4;)
alert tcp $HOME_NET any -> 154.12.37.146 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.12.37.146; sid:9103629; rev:4;)
alert tcp $HOME_NET any -> 103.73.162.97 14145 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.73.162.97; sid:9103634; rev:4;)
alert tcp $HOME_NET any -> 194.180.206.163 19181 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/194.180.206.163; sid:9103635; rev:4;)
alert tcp $HOME_NET any -> 43.110.54.62 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.110.54.62; sid:9103645; rev:4;)
alert tcp $HOME_NET any -> 18.162.147.217 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.162.147.217; sid:9103654; rev:4;)
alert tcp $HOME_NET any -> 103.101.176.234 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.101.176.234; sid:9103658; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 56435 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9103806; rev:4;)
alert tcp $HOME_NET any -> 47.74.43.122 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.74.43.122; sid:9103812; rev:4;)
alert tcp $HOME_NET any -> 23.254.219.25 61617 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.219.25; sid:9103814; rev:4;)
alert tcp $HOME_NET any -> 64.176.229.71 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.176.229.71; sid:9103888; rev:4;)
alert tcp $HOME_NET any -> 206.119.189.208 8787 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.189.208; sid:9103897; rev:4;)
alert tcp $HOME_NET any -> 101.36.127.214 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/101.36.127.214; sid:9103965; rev:4;)
alert tcp $HOME_NET any -> 175.41.169.29 80 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/175.41.169.29; sid:9104008; rev:4;)
alert tcp $HOME_NET any -> 156.251.16.136 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.251.16.136; sid:9104010; rev:4;)
alert tcp $HOME_NET any -> 156.251.16.125 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.251.16.125; sid:9104011; rev:4;)
alert tcp $HOME_NET any -> 154.194.251.43 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.194.251.43; sid:9104012; rev:4;)
alert tcp $HOME_NET any -> 107.161.86.90 5985 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.161.86.90; sid:9104015; rev:4;)
alert tcp $HOME_NET any -> 66.42.63.189 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.42.63.189; sid:9104017; rev:4;)
alert tcp $HOME_NET any -> 23.94.68.155 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.68.155; sid:9104057; rev:4;)
alert tcp $HOME_NET any -> 104.234.172.95 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.234.172.95; sid:9104072; rev:4;)
alert tcp $HOME_NET any -> 207.57.122.131 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.122.131; sid:9104084; rev:4;)
alert tcp $HOME_NET any -> 198.44.116.140 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.44.116.140; sid:9104085; rev:4;)
alert tcp $HOME_NET any -> 192.227.235.182 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.227.235.182; sid:9104086; rev:4;)
alert tcp $HOME_NET any -> 173.249.206.44 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.249.206.44; sid:9104087; rev:4;)
alert tcp $HOME_NET any -> 156.251.16.131 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.251.16.131; sid:9104088; rev:4;)
alert tcp $HOME_NET any -> 154.211.92.190 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.211.92.190; sid:9104089; rev:4;)
alert tcp $HOME_NET any -> 149.62.46.110 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.62.46.110; sid:9104090; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.124 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.124; sid:9104091; rev:4;)
alert tcp $HOME_NET any -> 103.197.25.8 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.197.25.8; sid:9104155; rev:4;)
alert tcp $HOME_NET any -> 104.234.172.217 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.234.172.217; sid:9104156; rev:4;)
alert tcp $HOME_NET any -> 23.95.193.221 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.193.221; sid:9104162; rev:4;)
alert tcp $HOME_NET any -> 43.247.135.185 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.247.135.185; sid:9104166; rev:4;)
alert tcp $HOME_NET any -> 43.247.135.185 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.247.135.185; sid:9104167; rev:4;)
alert tcp $HOME_NET any -> 38.55.199.242 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.55.199.242; sid:9104181; rev:4;)
alert tcp $HOME_NET any -> 130.94.33.140 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.33.140; sid:9104190; rev:4;)
alert tcp $HOME_NET any -> 103.110.221.162 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.110.221.162; sid:9104196; rev:4;)
alert tcp $HOME_NET any -> 104.194.88.185 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.194.88.185; sid:9104206; rev:4;)
alert tcp $HOME_NET any -> 104.194.88.185 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.194.88.185; sid:9104207; rev:4;)
alert tcp $HOME_NET any -> 103.106.230.240 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.106.230.240; sid:9104209; rev:4;)
alert tcp $HOME_NET any -> 23.254.242.24 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.254.242.24; sid:9104216; rev:4;)
alert tcp $HOME_NET any -> 104.168.22.209 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.22.209; sid:9104217; rev:4;)
alert tcp $HOME_NET any -> 104.168.22.209 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.168.22.209; sid:9104218; rev:4;)
alert tcp $HOME_NET any -> 154.211.86.169 40000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.211.86.169; sid:9104286; rev:4;)
alert tcp $HOME_NET any -> 134.122.162.95 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.162.95; sid:9104288; rev:4;)
alert tcp $HOME_NET any -> 207.56.20.68 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.56.20.68; sid:9104303; rev:4;)
alert tcp $HOME_NET any -> 206.238.68.19 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.68.19; sid:9104304; rev:4;)
alert tcp $HOME_NET any -> 206.238.68.19 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.238.68.19; sid:9104305; rev:4;)
alert tcp $HOME_NET any -> 205.234.170.141 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.234.170.141; sid:9104306; rev:4;)
alert tcp $HOME_NET any -> 192.255.132.233 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.255.132.233; sid:9104307; rev:4;)
alert tcp $HOME_NET any -> 192.227.235.182 50000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.227.235.182; sid:9104308; rev:4;)
alert tcp $HOME_NET any -> 192.187.118.178 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.187.118.178; sid:9104309; rev:4;)
alert tcp $HOME_NET any -> 154.91.61.100 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.61.100; sid:9104368; rev:4;)
alert tcp $HOME_NET any -> 154.91.61.98 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.61.98; sid:9104369; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.121 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.121; sid:9104371; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.120 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.120; sid:9104372; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.120 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.120; sid:9104373; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.119 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.119; sid:9104374; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.119 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.119; sid:9104375; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.118 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.118; sid:9104376; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.118 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.118; sid:9104377; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.106 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.106; sid:9104378; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.104 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.104; sid:9104379; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.104 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.104; sid:9104380; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.126 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.126; sid:9104381; rev:4;)
alert tcp $HOME_NET any -> 154.91.60.102 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.60.102; sid:9104382; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.126 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.126; sid:9104383; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.124 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.124; sid:9104384; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.119 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.119; sid:9104385; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.119 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.119; sid:9104386; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.118 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.118; sid:9104387; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.98 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.98; sid:9104390; rev:4;)
alert tcp $HOME_NET any -> 154.91.59.98 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.59.98; sid:9104391; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.126 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.126; sid:9104392; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.125 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.125; sid:9104393; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.125 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.125; sid:9104394; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.124 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.124; sid:9104395; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.124 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.124; sid:9104396; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.123 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.123; sid:9104397; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.123 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.123; sid:9104398; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.121 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.121; sid:9104399; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.121 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.121; sid:9104400; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.120 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.120; sid:9104401; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.120 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.120; sid:9104402; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.117 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.117; sid:9104403; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.117 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.117; sid:9104404; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.116 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.116; sid:9104405; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.116 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.116; sid:9104406; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.115 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.115; sid:9104407; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.111 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.111; sid:9104408; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.110 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.110; sid:9104409; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.104 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.104; sid:9104410; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.104 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.104; sid:9104412; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.101 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.101; sid:9104413; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.100 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.100; sid:9104414; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.100 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.100; sid:9104415; rev:4;)
alert tcp $HOME_NET any -> 154.91.58.99 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.58.99; sid:9104416; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.124 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.124; sid:9104417; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.123 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.123; sid:9104418; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.122 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.122; sid:9104419; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.121 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.121; sid:9104420; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.119 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.119; sid:9104422; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.111 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.111; sid:9104423; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.107 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.107; sid:9104425; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.103 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.103; sid:9104426; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.101 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.101; sid:9104427; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.100 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.100; sid:9104428; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.99 8094 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.99; sid:9104429; rev:4;)
alert tcp $HOME_NET any -> 154.91.57.99 8074 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.57.99; sid:9104430; rev:4;)
alert tcp $HOME_NET any -> 103.115.108.111 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.115.108.111; sid:9104432; rev:4;)
alert tcp $HOME_NET any -> 92.204.242.63 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/92.204.242.63; sid:9104433; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.235 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.235; sid:9104434; rev:4;)
alert tcp $HOME_NET any -> 45.130.147.57 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.130.147.57; sid:9104440; rev:4;)
alert tcp $HOME_NET any -> 8.216.20.25 4433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.216.20.25; sid:9104442; rev:4;)
alert tcp $HOME_NET any -> 52.128.224.234 8089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/52.128.224.234; sid:9104467; rev:4;)
alert tcp $HOME_NET any -> 38.55.200.183 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.55.200.183; sid:9104475; rev:4;)
alert tcp $HOME_NET any -> 18.163.8.203 31772 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/18.163.8.203; sid:9104476; rev:4;)
alert tcp $HOME_NET any -> 8.211.194.92 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.211.194.92; sid:9104478; rev:4;)
alert tcp $HOME_NET any -> 8.210.248.241 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.210.248.241; sid:9104479; rev:4;)
alert tcp $HOME_NET any -> 149.88.73.229 8889 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.88.73.229; sid:9104543; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.122 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.122; sid:9104544; rev:4;)
alert tcp $HOME_NET any -> 146.235.216.7 54321 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/146.235.216.7; sid:9104545; rev:4;)
alert tcp $HOME_NET any -> 145.79.143.166 8000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/145.79.143.166; sid:9104547; rev:4;)
alert tcp $HOME_NET any -> 104.223.59.151 9004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.223.59.151; sid:9104590; rev:4;)
alert tcp $HOME_NET any -> 104.143.32.40 12222 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.143.32.40; sid:9104591; rev:4;)
alert tcp $HOME_NET any -> 103.230.15.51 18080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.230.15.51; sid:9104593; rev:4;)
alert tcp $HOME_NET any -> 103.159.206.136 65086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.159.206.136; sid:9104595; rev:4;)
alert tcp $HOME_NET any -> 103.153.36.86 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.153.36.86; sid:9104596; rev:4;)
alert tcp $HOME_NET any -> 103.149.93.150 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.149.93.150; sid:9104597; rev:4;)
alert tcp $HOME_NET any -> 206.119.189.208 7979 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.189.208; sid:9104600; rev:4;)
alert tcp $HOME_NET any -> 206.119.167.239 32899 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.119.167.239; sid:9104601; rev:4;)
alert tcp $HOME_NET any -> 199.187.25.100 52660 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/199.187.25.100; sid:9104602; rev:4;)
alert tcp $HOME_NET any -> 199.187.25.100 51001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/199.187.25.100; sid:9104603; rev:4;)
alert tcp $HOME_NET any -> 192.255.236.156 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.255.236.156; sid:9104604; rev:4;)
alert tcp $HOME_NET any -> 192.238.141.140 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.238.141.140; sid:9104605; rev:4;)
alert tcp $HOME_NET any -> 173.249.220.138 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.249.220.138; sid:9104609; rev:4;)
alert tcp $HOME_NET any -> 154.93.103.232 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.93.103.232; sid:9104610; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.59 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.59; sid:9104650; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.46 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.46; sid:9104652; rev:4;)
alert tcp $HOME_NET any -> 154.88.100.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.100.37; sid:9104653; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.42; sid:9104654; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.36; sid:9104656; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.34 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.34; sid:9104657; rev:4;)
alert tcp $HOME_NET any -> 83.229.126.134 8506 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/83.229.126.134; sid:9104680; rev:4;)
alert tcp $HOME_NET any -> 45.76.146.82 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.146.82; sid:9104831; rev:4;)
alert tcp $HOME_NET any -> 156.251.16.126 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.251.16.126; sid:9105068; rev:4;)
alert tcp $HOME_NET any -> 156.239.238.204 7777 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.239.238.204; sid:9105069; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8484 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9105070; rev:4;)
alert tcp $HOME_NET any -> 152.32.201.214 25994 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/152.32.201.214; sid:9105084; rev:4;)
alert tcp $HOME_NET any -> 43.106.28.184 44321 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.106.28.184; sid:9105089; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.206 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.206; sid:9105090; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.205 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.205; sid:9105091; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.203 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.203; sid:9105092; rev:4;)
alert tcp $HOME_NET any -> 38.46.15.202 4141 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.46.15.202; sid:9105093; rev:4;)
alert tcp $HOME_NET any -> 8.219.154.237 44321 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.154.237; sid:9105094; rev:4;)
alert tcp $HOME_NET any -> 172.235.208.42 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.235.208.42; sid:9105304; rev:4;)
alert tcp $HOME_NET any -> 144.225.137.26 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/144.225.137.26; sid:9105328; rev:4;)
alert tcp $HOME_NET any -> 45.77.240.46 39756 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.240.46; sid:9105334; rev:4;)
alert tcp $HOME_NET any -> 38.207.178.19 18082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.207.178.19; sid:9105340; rev:4;)
alert tcp $HOME_NET any -> 202.61.138.81 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/202.61.138.81; sid:9105469; rev:4;)
alert tcp $HOME_NET any -> 185.244.212.122 8591 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.244.212.122; sid:9105471; rev:4;)
alert tcp $HOME_NET any -> 172.235.208.160 3306 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.235.208.160; sid:9105472; rev:4;)
alert tcp $HOME_NET any -> 103.77.210.79 9001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.77.210.79; sid:9105534; rev:4;)
alert tcp $HOME_NET any -> 47.76.252.195 10033 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.76.252.195; sid:9105539; rev:4;)
alert tcp $HOME_NET any -> 107.173.51.146 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.51.146; sid:9105609; rev:4;)
alert tcp $HOME_NET any -> 23.94.218.120 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.218.120; sid:9105610; rev:4;)
alert tcp $HOME_NET any -> 45.76.145.171 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.145.171; sid:9105613; rev:4;)
alert tcp $HOME_NET any -> 206.188.196.221 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.188.196.221; sid:9105614; rev:4;)
alert tcp $HOME_NET any -> 45.63.120.124 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.63.120.124; sid:9105615; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105616; rev:4;)
alert tcp $HOME_NET any -> 45.77.28.40 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.28.40; sid:9105617; rev:4;)
alert tcp $HOME_NET any -> 172.245.80.41 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.245.80.41; sid:9105618; rev:4;)
alert tcp $HOME_NET any -> 194.213.18.117 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/194.213.18.117; sid:9105621; rev:4;)
alert tcp $HOME_NET any -> 206.188.196.221 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.188.196.221; sid:9105622; rev:4;)
alert tcp $HOME_NET any -> 45.76.145.171 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.145.171; sid:9105623; rev:4;)
alert tcp $HOME_NET any -> 45.63.120.124 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.63.120.124; sid:9105624; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105625; rev:4;)
alert tcp $HOME_NET any -> 8.219.211.139 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.219.211.139; sid:9105629; rev:4;)
alert tcp $HOME_NET any -> 130.94.16.122 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.16.122; sid:9105630; rev:4;)
alert tcp $HOME_NET any -> 47.238.6.14 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.238.6.14; sid:9105631; rev:4;)
alert tcp $HOME_NET any -> 8.210.253.7 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/8.210.253.7; sid:9105632; rev:4;)
alert tcp $HOME_NET any -> 45.77.28.40 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.28.40; sid:9105638; rev:4;)
alert tcp $HOME_NET any -> 23.94.218.120 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.94.218.120; sid:9105645; rev:4;)
alert tcp $HOME_NET any -> 206.188.196.221 8081 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.188.196.221; sid:9105652; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105654; rev:4;)
alert tcp $HOME_NET any -> 45.76.145.171 6667 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.145.171; sid:9105660; rev:4;)
alert tcp $HOME_NET any -> 38.60.245.181 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.245.181; sid:9105661; rev:4;)
alert tcp $HOME_NET any -> 130.94.16.122 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.16.122; sid:9105663; rev:4;)
alert tcp $HOME_NET any -> 38.60.245.181 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.60.245.181; sid:9105665; rev:4;)
alert tcp $HOME_NET any -> 206.188.196.221 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/206.188.196.221; sid:9105666; rev:4;)
alert tcp $HOME_NET any -> 173.254.211.27 2096 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/173.254.211.27; sid:9105671; rev:4;)
alert tcp $HOME_NET any -> 45.77.38.40 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.38.40; sid:9105673; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105674; rev:4;)
alert tcp $HOME_NET any -> 45.77.28.40 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.28.40; sid:9105675; rev:4;)
alert tcp $HOME_NET any -> 193.42.24.215 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.42.24.215; sid:9105682; rev:4;)
alert tcp $HOME_NET any -> 102.129.165.177 63525 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.129.165.177; sid:9105683; rev:4;)
alert tcp $HOME_NET any -> 83.229.123.240 61144 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/83.229.123.240; sid:9105691; rev:4;)
alert tcp $HOME_NET any -> 83.229.123.240 23679 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/83.229.123.240; sid:9105692; rev:4;)
alert tcp $HOME_NET any -> 103.212.186.12 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.212.186.12; sid:9105849; rev:4;)
alert tcp $HOME_NET any -> 82.23.246.97 8023 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.23.246.97; sid:9105850; rev:4;)
alert tcp $HOME_NET any -> 82.23.246.164 8023 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.23.246.164; sid:9105851; rev:4;)
alert tcp $HOME_NET any -> 82.23.246.123 8023 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/82.23.246.123; sid:9105852; rev:4;)
alert tcp $HOME_NET any -> 45.192.242.132 9178 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.242.132; sid:9105861; rev:4;)
alert tcp $HOME_NET any -> 23.95.14.48 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.95.14.48; sid:9105865; rev:4;)
alert tcp $HOME_NET any -> 192.210.193.156 8090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.210.193.156; sid:9105870; rev:4;)
alert tcp $HOME_NET any -> 166.88.97.92 808 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.88.97.92; sid:9105872; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.42 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.42; sid:9105874; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.37 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.37; sid:9105876; rev:4;)
alert tcp $HOME_NET any -> 160.124.88.200 30004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/160.124.88.200; sid:9105878; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.39; sid:9105880; rev:4;)
alert tcp $HOME_NET any -> 158.94.209.159 9981 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/158.94.209.159; sid:9105881; rev:4;)
alert tcp $HOME_NET any -> 154.88.98.54 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.98.54; sid:9105882; rev:4;)
alert tcp $HOME_NET any -> 155.117.46.184 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/155.117.46.184; sid:9105883; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.41 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.41; sid:9105885; rev:4;)
alert tcp $HOME_NET any -> 154.88.99.52 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.99.52; sid:9105891; rev:4;)
alert tcp $HOME_NET any -> 154.89.148.121 18084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.89.148.121; sid:9105893; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.33 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.33; sid:9105894; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.39 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.39; sid:9105895; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.38 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.38; sid:9105897; rev:4;)
alert tcp $HOME_NET any -> 154.88.96.41 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.96.41; sid:9105899; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.47 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.47; sid:9105900; rev:4;)
alert tcp $HOME_NET any -> 154.88.97.36 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.97.36; sid:9105903; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.58 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.58; sid:9105904; rev:4;)
alert tcp $HOME_NET any -> 154.88.103.46 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.103.46; sid:9105907; rev:4;)
alert tcp $HOME_NET any -> 154.88.102.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.102.35; sid:9105909; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.61 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.61; sid:9105910; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.60 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.60; sid:9105914; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.56 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.56; sid:9105915; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.50 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.50; sid:9105916; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.46 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.46; sid:9105918; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.57 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.57; sid:9105919; rev:4;)
alert tcp $HOME_NET any -> 154.88.101.35 8884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.88.101.35; sid:9105922; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8589 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9105923; rev:4;)
alert tcp $HOME_NET any -> 154.213.181.153 8384 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.213.181.153; sid:9105924; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 8086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105926; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105927; rev:4;)
alert tcp $HOME_NET any -> 149.28.30.98 8090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.28.30.98; sid:9105928; rev:4;)
alert tcp $HOME_NET any -> 107.173.144.112 8086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.173.144.112; sid:9105941; rev:4;)
alert tcp $HOME_NET any -> 103.30.76.214 8779 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.30.76.214; sid:9105945; rev:4;)
alert tcp $HOME_NET any -> 198.44.182.236 9527 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/198.44.182.236; sid:9106017; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 60004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9106046; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 60003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9106047; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9106048; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.126 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.126; sid:9106049; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 60004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9106050; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 60003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9106051; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9106052; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.122 60004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.122; sid:9106053; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.122 60003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.122; sid:9106054; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.122 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.122; sid:9106055; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.122 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.122; sid:9106056; rev:4;)
alert tcp $HOME_NET any -> 47.90.209.157 18084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.90.209.157; sid:9106064; rev:4;)
alert tcp $HOME_NET any -> 38.47.122.87 5432 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.47.122.87; sid:9106081; rev:4;)
alert tcp $HOME_NET any -> 103.212.186.12 443 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/103.212.186.12; sid:9106173; rev:4;)
alert tcp $HOME_NET any -> 103.115.108.111 8000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.115.108.111; sid:9106199; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 52661 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106291; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 18884 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106292; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 9993 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106293; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 9991 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106294; rev:4;)
alert tcp $HOME_NET any -> 208.167.245.124 7771 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/208.167.245.124; sid:9106295; rev:4;)
alert tcp $HOME_NET any -> 143.92.62.62 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/143.92.62.62; sid:9106329; rev:4;)
alert tcp $HOME_NET any -> 101.32.34.248 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/101.32.34.248; sid:9106336; rev:4;)
alert tcp $HOME_NET any -> 47.86.171.139 6789 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.86.171.139; sid:9106339; rev:4;)
alert tcp $HOME_NET any -> 172.235.208.160 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.235.208.160; sid:9106393; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 60004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9106406; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 60003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9106407; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9106408; rev:4;)
alert tcp $HOME_NET any -> 107.175.94.184 61238 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.175.94.184; sid:9106414; rev:4;)
alert tcp $HOME_NET any -> 103.212.186.12 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.212.186.12; sid:9106415; rev:4;)
alert tcp $HOME_NET any -> 193.42.24.215 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.42.24.215; sid:9106417; rev:4;)
alert tcp $HOME_NET any -> 202.61.73.72 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/202.61.73.72; sid:9106577; rev:4;)
alert tcp $HOME_NET any -> 122.10.5.218 8003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/122.10.5.218; sid:9106603; rev:4;)
alert tcp $HOME_NET any -> 66.179.31.191 8099 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.179.31.191; sid:9106609; rev:4;)
alert tcp $HOME_NET any -> 66.154.119.224 8899 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.154.119.224; sid:9106610; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.124 60004 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.124; sid:9106782; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.124 60003 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.124; sid:9106783; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.124 60001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.124; sid:9106784; rev:4;)
alert tcp $HOME_NET any -> 146.19.213.28 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/146.19.213.28; sid:9106785; rev:4;)
alert tcp $HOME_NET any -> 134.255.211.140 9300 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.255.211.140; sid:9106786; rev:4;)
alert tcp $HOME_NET any -> 78.13.60.90 14448 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/78.13.60.90; sid:9106791; rev:4;)
alert tcp $HOME_NET any -> 43.246.210.160 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.246.210.160; sid:9106795; rev:4;)
alert tcp $HOME_NET any -> 207.57.122.131 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.122.131; sid:9106813; rev:4;)
alert tcp $HOME_NET any -> 104.225.238.193 10010 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.225.238.193; sid:9106823; rev:4;)
alert tcp $HOME_NET any -> 68.64.177.32 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/68.64.177.32; sid:9106895; rev:4;)
alert tcp $HOME_NET any -> 68.64.177.32 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/68.64.177.32; sid:9106896; rev:4;)
alert tcp $HOME_NET any -> 50.114.172.219 20001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.172.219; sid:9106897; rev:4;)
alert tcp $HOME_NET any -> 45.77.220.145 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.77.220.145; sid:9106912; rev:4;)
alert tcp $HOME_NET any -> 45.125.32.79 6699 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.125.32.79; sid:9106913; rev:4;)
alert tcp $HOME_NET any -> 38.54.42.246 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.42.246; sid:9106918; rev:4;)
alert tcp $HOME_NET any -> 102.220.88.241 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.220.88.241; sid:9106924; rev:4;)
alert tcp $HOME_NET any -> 102.220.88.241 4444 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.220.88.241; sid:9106925; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.15 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.15; sid:9107049; rev:4;)
alert tcp $HOME_NET any -> 107.172.73.26 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.73.26; sid:9107071; rev:4;)
alert tcp $HOME_NET any -> 45.192.213.11 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.192.213.11; sid:9107074; rev:4;)
alert tcp $HOME_NET any -> 64.118.128.131 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.118.128.131; sid:9107077; rev:4;)
alert tcp $HOME_NET any -> 89.106.84.228 9443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/89.106.84.228; sid:9107086; rev:4;)
alert tcp $HOME_NET any -> 94.125.101.85 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/94.125.101.85; sid:9107092; rev:4;)
alert tcp $HOME_NET any -> 66.23.197.18 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/66.23.197.18; sid:9107100; rev:4;)
alert tcp $HOME_NET any -> 162.243.73.157 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/162.243.73.157; sid:9107131; rev:4;)
alert tcp $HOME_NET any -> 130.94.66.82 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.66.82; sid:9107143; rev:4;)
alert tcp $HOME_NET any -> 130.94.30.168 8090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.30.168; sid:9107144; rev:4;)
alert tcp $HOME_NET any -> 47.129.3.232 4433 (msg:"Public Mosaic C2 VShell"; reference:url,publicmosaic.com/ip/47.129.3.232; sid:9107153; rev:4;)
alert tcp $HOME_NET any -> 43.251.227.131 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.251.227.131; sid:9107156; rev:4;)
alert tcp $HOME_NET any -> 192.210.197.13 12313 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.210.197.13; sid:9107168; rev:4;)
alert tcp $HOME_NET any -> 192.210.197.131 12313 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.210.197.131; sid:9107169; rev:4;)
alert tcp $HOME_NET any -> 192.187.118.180 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.187.118.180; sid:9107170; rev:4;)
alert tcp $HOME_NET any -> 192.187.118.179 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.187.118.179; sid:9107171; rev:4;)
alert tcp $HOME_NET any -> 177.3.88.123 32425 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/177.3.88.123; sid:9107182; rev:4;)
alert tcp $HOME_NET any -> 217.60.76.178 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/217.60.76.178; sid:9107270; rev:4;)
alert tcp $HOME_NET any -> 217.60.76.178 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/217.60.76.178; sid:9107272; rev:4;)
alert tcp $HOME_NET any -> 45.154.33.156 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.154.33.156; sid:9107276; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.180 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.180; sid:9107280; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.180 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.180; sid:9107281; rev:4;)
alert tcp $HOME_NET any -> 178.16.53.215 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.16.53.215; sid:9107286; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.50 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.50; sid:9107300; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.50 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.50; sid:9107301; rev:4;)
alert tcp $HOME_NET any -> 130.94.29.211 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.29.211; sid:9107321; rev:4;)
alert tcp $HOME_NET any -> 178.83.203.92 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.83.203.92; sid:9107325; rev:4;)
alert tcp $HOME_NET any -> 178.83.203.92 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/178.83.203.92; sid:9107326; rev:4;)
alert tcp $HOME_NET any -> 207.56.20.68 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.56.20.68; sid:9107332; rev:4;)
alert tcp $HOME_NET any -> 154.91.180.61 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.91.180.61; sid:9107358; rev:4;)
alert tcp $HOME_NET any -> 23.252.123.195 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.252.123.195; sid:9107367; rev:4;)
alert tcp $HOME_NET any -> 147.79.20.132 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/147.79.20.132; sid:9107372; rev:4;)
alert tcp $HOME_NET any -> 38.14.248.161 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.14.248.161; sid:9107375; rev:4;)
alert tcp $HOME_NET any -> 103.124.107.93 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.124.107.93; sid:9107385; rev:4;)
alert tcp $HOME_NET any -> 149.62.46.110 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.62.46.110; sid:9107397; rev:4;)
alert tcp $HOME_NET any -> 139.180.213.27 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.213.27; sid:9107412; rev:4;)
alert tcp $HOME_NET any -> 139.180.213.27 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/139.180.213.27; sid:9107413; rev:4;)
alert tcp $HOME_NET any -> 193.149.190.254 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.149.190.254; sid:9107419; rev:4;)
alert tcp $HOME_NET any -> 166.88.77.149 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/166.88.77.149; sid:9107428; rev:4;)
alert tcp $HOME_NET any -> 103.124.157.49 8848 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.124.157.49; sid:9107435; rev:4;)
alert tcp $HOME_NET any -> 103.124.157.49 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.124.157.49; sid:9107436; rev:4;)
alert tcp $HOME_NET any -> 192.227.235.182 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.227.235.182; sid:9107439; rev:4;)
alert tcp $HOME_NET any -> 141.11.139.200 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/141.11.139.200; sid:9107442; rev:4;)
alert tcp $HOME_NET any -> 205.185.121.227 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.185.121.227; sid:9107443; rev:4;)
alert tcp $HOME_NET any -> 43.162.210.61 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.162.210.61; sid:9107474; rev:4;)
alert tcp $HOME_NET any -> 38.76.194.239 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.76.194.239; sid:9107543; rev:4;)
alert tcp $HOME_NET any -> 207.57.125.216 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/207.57.125.216; sid:9107545; rev:4;)
alert tcp $HOME_NET any -> 154.219.101.148 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.219.101.148; sid:9107575; rev:4;)
alert tcp $HOME_NET any -> 45.76.110.248 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.110.248; sid:9107577; rev:4;)
alert tcp $HOME_NET any -> 45.76.110.248 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.76.110.248; sid:9107578; rev:4;)
alert tcp $HOME_NET any -> 205.186.112.213 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.186.112.213; sid:9107609; rev:4;)
alert tcp $HOME_NET any -> 93.177.77.234 8085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/93.177.77.234; sid:9107616; rev:4;)
alert tcp $HOME_NET any -> 102.204.223.106 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.204.223.106; sid:9107627; rev:4;)
alert tcp $HOME_NET any -> 47.243.191.83 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.243.191.83; sid:9108747; rev:4;)
alert tcp $HOME_NET any -> 38.175.192.57 8013 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.175.192.57; sid:9108753; rev:4;)
alert tcp $HOME_NET any -> 193.149.190.254 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/193.149.190.254; sid:9108774; rev:4;)
alert tcp $HOME_NET any -> 149.88.73.76 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/149.88.73.76; sid:9108779; rev:4;)
alert tcp $HOME_NET any -> 217.216.59.19 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/217.216.59.19; sid:9108821; rev:4;)
alert tcp $HOME_NET any -> 130.94.29.211 8090 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.29.211; sid:9108831; rev:4;)
alert tcp $HOME_NET any -> 116.89.250.121 18084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/116.89.250.121; sid:9108835; rev:4;)
alert tcp $HOME_NET any -> 43.111.235.219 5555 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.111.235.219; sid:9108862; rev:4;)
alert tcp $HOME_NET any -> 43.129.165.206 1433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.129.165.206; sid:9108863; rev:4;)
alert tcp $HOME_NET any -> 43.128.121.11 50001 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.128.121.11; sid:9108864; rev:4;)
alert tcp $HOME_NET any -> 38.76.202.73 7878 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.76.202.73; sid:9108871; rev:4;)
alert tcp $HOME_NET any -> 38.54.95.51 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.54.95.51; sid:9108872; rev:4;)
alert tcp $HOME_NET any -> 38.49.38.233 9976 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.49.38.233; sid:9108873; rev:4;)
alert tcp $HOME_NET any -> 38.14.248.161 9988 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.14.248.161; sid:9108874; rev:4;)
alert tcp $HOME_NET any -> 38.14.248.161 9889 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/38.14.248.161; sid:9108875; rev:4;)
alert tcp $HOME_NET any -> 23.224.221.82 4096 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/23.224.221.82; sid:9108881; rev:4;)
alert tcp $HOME_NET any -> 212.237.217.163 28443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/212.237.217.163; sid:9108885; rev:4;)
alert tcp $HOME_NET any -> 212.237.217.163 18443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/212.237.217.163; sid:9108886; rev:4;)
alert tcp $HOME_NET any -> 205.234.170.141 49821 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/205.234.170.141; sid:9108888; rev:4;)
alert tcp $HOME_NET any -> 186.244.216.113 10000 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/186.244.216.113; sid:9108899; rev:4;)
alert tcp $HOME_NET any -> 185.243.41.216 8887 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.243.41.216; sid:9108901; rev:4;)
alert tcp $HOME_NET any -> 185.243.41.216 8886 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/185.243.41.216; sid:9108902; rev:4;)
alert tcp $HOME_NET any -> 172.245.247.21 3211 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/172.245.247.21; sid:9108913; rev:4;)
alert tcp $HOME_NET any -> 165.154.205.178 31480 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/165.154.205.178; sid:9108918; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.50 8086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.50; sid:9108925; rev:4;)
alert tcp $HOME_NET any -> 156.238.121.180 8086 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/156.238.121.180; sid:9108926; rev:4;)
alert tcp $HOME_NET any -> 154.81.37.187 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.81.37.187; sid:9108930; rev:4;)
alert tcp $HOME_NET any -> 154.36.183.100 18089 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.36.183.100; sid:9108931; rev:4;)
alert tcp $HOME_NET any -> 154.222.31.149 18818 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.222.31.149; sid:9108932; rev:4;)
alert tcp $HOME_NET any -> 134.209.214.178 10911 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.209.214.178; sid:9108951; rev:4;)
alert tcp $HOME_NET any -> 130.94.29.211 8091 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.29.211; sid:9108952; rev:4;)
alert tcp $HOME_NET any -> 128.241.231.135 18082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/128.241.231.135; sid:9108956; rev:4;)
alert tcp $HOME_NET any -> 128.241.231.135 12085 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/128.241.231.135; sid:9108957; rev:4;)
alert tcp $HOME_NET any -> 107.174.92.241 61083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.174.92.241; sid:9108991; rev:4;)
alert tcp $HOME_NET any -> 107.172.73.26 8082 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.172.73.26; sid:9108994; rev:4;)
alert tcp $HOME_NET any -> 107.148.78.97 8989 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/107.148.78.97; sid:9108996; rev:4;)
alert tcp $HOME_NET any -> 104.143.32.40 2580 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/104.143.32.40; sid:9109000; rev:4;)
alert tcp $HOME_NET any -> 103.212.186.92 65533 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.212.186.92; sid:9109006; rev:4;)
alert tcp $HOME_NET any -> 103.117.137.230 38888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.117.137.230; sid:9109008; rev:4;)
alert tcp $HOME_NET any -> 103.115.64.31 33333 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.115.64.31; sid:9109009; rev:4;)
alert tcp $HOME_NET any -> 102.129.165.177 13562 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/102.129.165.177; sid:9109012; rev:4;)
alert tcp $HOME_NET any -> 83.229.123.249 5556 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/83.229.123.249; sid:9109034; rev:4;)
alert tcp $HOME_NET any -> 69.48.228.144 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/69.48.228.144; sid:9109047; rev:4;)
alert tcp $HOME_NET any -> 47.243.191.83 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.243.191.83; sid:9109071; rev:4;)
alert tcp $HOME_NET any -> 45.152.64.65 41022 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.152.64.65; sid:9109084; rev:4;)
alert tcp $HOME_NET any -> 64.81.30.24 8812 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.81.30.24; sid:9109090; rev:4;)
alert tcp $HOME_NET any -> 103.136.150.98 60339 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.136.150.98; sid:9109113; rev:4;)
alert tcp $HOME_NET any -> 45.136.14.91 1433 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.136.14.91; sid:9109143; rev:4;)
alert tcp $HOME_NET any -> 134.122.140.110 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/134.122.140.110; sid:9109203; rev:4;)
alert tcp $HOME_NET any -> 101.99.91.180 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/101.99.91.180; sid:9109214; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.125 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.125; sid:9109265; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.124 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.124; sid:9109266; rev:4;)
alert tcp $HOME_NET any -> 148.66.17.123 60002 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/148.66.17.123; sid:9109267; rev:4;)
alert tcp $HOME_NET any -> 130.94.30.83 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.30.83; sid:9109271; rev:4;)
alert tcp $HOME_NET any -> 64.118.128.131 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.118.128.131; sid:9109351; rev:4;)
alert tcp $HOME_NET any -> 209.99.187.125 40111 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/209.99.187.125; sid:9109378; rev:4;)
alert tcp $HOME_NET any -> 64.81.114.71 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/64.81.114.71; sid:9109401; rev:4;)
alert tcp $HOME_NET any -> 154.219.115.123 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/154.219.115.123; sid:9109443; rev:4;)
alert tcp $HOME_NET any -> 43.156.133.8 80 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.156.133.8; sid:9109477; rev:4;)
alert tcp $HOME_NET any -> 37.187.73.224 8888 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/37.187.73.224; sid:9109478; rev:4;)
alert tcp $HOME_NET any -> 167.17.47.213 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/167.17.47.213; sid:9109481; rev:4;)
alert tcp $HOME_NET any -> 113.20.0.225 2096 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/113.20.0.225; sid:9109489; rev:4;)
alert tcp $HOME_NET any -> 50.114.184.76 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/50.114.184.76; sid:9109494; rev:4;)
alert tcp $HOME_NET any -> 47.243.191.83 8443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/47.243.191.83; sid:9109496; rev:4;)
alert tcp $HOME_NET any -> 130.94.34.35 443 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/130.94.34.35; sid:9109500; rev:4;)
alert tcp $HOME_NET any -> 192.210.197.13 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.210.197.13; sid:9109545; rev:4;)
alert tcp $HOME_NET any -> 158.94.209.99 8088 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/158.94.209.99; sid:9109552; rev:4;)
alert tcp $HOME_NET any -> 103.115.49.124 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/103.115.49.124; sid:9109553; rev:4;)
alert tcp $HOME_NET any -> 45.42.40.55 8084 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/45.42.40.55; sid:9109586; rev:4;)
alert tcp $HOME_NET any -> 43.242.128.150 8083 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/43.242.128.150; sid:9109588; rev:4;)
alert tcp $HOME_NET any -> 192.210.197.131 8080 (msg:"Public Mosaic malware distribution host VShell"; reference:url,publicmosaic.com/ip/192.210.197.131; sid:9109621; rev:4;)