################################################################
# abuse.ch Suricata IDS SSL Certificate Ruleset                #
# For Suricata 4.1.0 or newer                                  #
# Last updated: 2024-10-05 12:51:27 UTC                        #
#                                                              #
# Terms Of Use: https://sslbl.abuse.ch/blacklist/              #
# For questions please contact sslbl [at] abuse.ch             #
################################################################
#
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"b0:8a:49:39:fb:88:f3:75:a2:75:7e:ad:dc:47:b1:fb:8b:55:44:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b08a4939fb88f375a2757eaddc47b1fb8b554439/; sid:903200000; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"5a:fc:23:6d:1d:d0:0c:9c:45:45:7b:75:22:6b:50:1b:81:5a:59:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5afc236d1dd00c9c45457b75226b501b815a59c7/; sid:903200001; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"86:d6:aa:de:4b:a1:41:4a:91:b1:e7:fb:3c:dd:7d:50:36:92:f4:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86d6aade4ba1414a91b1e7fb3cdd7d503692f410/; sid:903200002; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"65:a7:7d:36:d1:b5:36:65:f6:0d:19:71:89:24:50:4f:7d:3f:95:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/65a77d36d1b53665f60d19718924504f7d3f9508/; sid:903200003; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"21:93:fd:03:3d:69:5c:69:b0:e4:2d:19:08:43:cd:e9:7d:d8:05:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2193fd033d695c69b0e42d190843cde97dd80507/; sid:903200004; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"67:98:30:81:90:fb:07:05:36:af:19:02:3a:e8:9b:a4:bd:54:e9:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6798308190fb070536af19023ae89ba4bd54e9b6/; sid:903200005; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"8b:e4:db:c9:80:14:e3:2b:ce:03:41:f6:75:4a:23:24:49:c7:7d:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8be4dbc98014e32bce0341f6754a232449c77d3d/; sid:903200006; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"b3:ff:91:c3:10:bf:2b:68:73:c9:0b:fc:87:08:06:ef:4e:ae:c4:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b3ff91c310bf2b6873c90bfc870806ef4eaec49a/; sid:903200007; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"0d:22:74:58:54:86:af:6a:ac:c8:af:e0:dd:76:60:b9:0a:17:71:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0d2274585486af6aacc8afe0dd7660b90a17717b/; sid:903200008; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"27:9c:80:7d:e6:cb:27:72:6d:4c:c5:7f:a4:7c:ac:94:50:b9:c6:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/279c807de6cb27726d4cc57fa47cac9450b9c69e/; sid:903200009; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"84:90:79:a5:85:5a:6b:6d:50:72:84:45:d1:26:1b:f3:e8:88:5b:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/849079a5855a6b6d50728445d1261bf3e8885bef/; sid:903200010; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"28:49:e8:47:e0:d5:ba:85:bf:59:18:2a:92:e5:35:41:d5:5f:a8:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2849e847e0d5ba85bf59182a92e53541d55fa8dc/; sid:903200011; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"69:c6:78:70:7b:fd:48:36:29:15:71:fb:ae:40:04:59:c9:0b:9e:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69c678707bfd4836291571fbae400459c90b9eed/; sid:903200012; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"79:67:bb:dd:e9:c1:17:46:8d:26:cd:de:db:20:e2:1c:46:63:bd:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7967bbdde9c117468d26cddedb20e21c4663bdd7/; sid:903200013; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"04:3a:68:f0:48:e8:ce:74:70:ae:58:86:0c:58:d2:58:79:66:8c:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/043a68f048e8ce7470ae58860c58d25879668c91/; sid:903200014; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"38:5f:c0:e4:f3:e0:c9:a7:7a:ea:96:3d:a7:0b:bd:ae:1b:89:09:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/385fc0e4f3e0c9a77aea963da70bbdae1b8909cb/; sid:903200015; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"69:a6:70:c5:f6:07:8b:33:c0:1e:1c:a5:97:d6:e8:5b:8d:35:14:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69a670c5f6078b33c01e1ca597d6e85b8d35141e/; sid:903200016; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"c6:f8:28:94:77:fb:64:80:f5:85:94:eb:1d:84:09:69:94:fa:d6:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6f8289477fb6480f58594eb1d84096994fad6ee/; sid:903200017; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"2a:5d:b0:16:a7:07:8b:ba:81:fb:a8:5d:ac:97:51:f2:1f:93:40:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a5db016a7078bba81fba85dac9751f21f9340bd/; sid:903200018; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"cb:98:d0:d2:48:1b:3a:c3:e4:f9:de:53:eb:7f:86:cd:d0:8e:8d:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb98d0d2481b3ac3e4f9de53eb7f86cdd08e8da2/; sid:903200019; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"3c:54:69:2d:86:96:90:86:a5:fb:50:fd:4b:88:cb:dc:fa:b5:a6:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c54692d86969086a5fb50fd4b88cbdcfab5a60e/; sid:903200020; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"76:40:59:d7:bf:d2:5e:98:fc:66:64:bc:82:82:b7:99:df:63:91:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/764059d7bfd25e98fc6664bc8282b799df639140/; sid:903200021; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"27:b9:f5:b7:92:09:d9:5f:1e:70:a7:89:dc:fb:a6:82:31:ea:c1:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27b9f5b79209d95f1e70a789dcfba68231eac10e/; sid:903200022; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a9:82:9a:4e:5b:55:83:9e:4b:41:a5:20:37:75:4d:6b:df:21:24:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9829a4e5b55839e4b41a52037754d6bdf212420/; sid:903200023; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1c:20:6f:e2:b1:c3:82:f2:21:79:c8:f2:68:d5:6c:97:16:53:1e:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c206fe2b1c382f22179c8f268d56c9716531e49/; sid:903200024; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"43:00:63:c6:04:a4:b2:79:d2:16:f9:c2:8a:0b:8d:ef:19:38:e0:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/430063c604a4b279d216f9c28a0b8def1938e00d/; sid:903200025; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"8f:0c:95:89:67:4c:20:f8:42:11:cf:27:e7:04:de:fc:07:da:f7:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f0c9589674c20f84211cf27e704defc07daf7b5/; sid:903200026; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"aa:c6:4c:aa:32:df:3e:07:84:36:71:3d:83:20:a4:b0:6b:5d:d6:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aac64caa32df3e078436713d8320a4b06b5dd67d/; sid:903200027; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"1e:74:0b:1d:ab:c0:40:6d:46:35:92:d0:9e:99:95:30:bb:fd:b4:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e740b1dabc0406d463592d09e999530bbfdb4ea/; sid:903200028; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d4:fa:65:54:b5:f6:24:3a:50:eb:14:53:e4:40:bb:a5:8d:a5:6f:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4fa6554b5f6243a50eb1453e440bba58da56f61/; sid:903200029; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"9a:04:47:53:da:a1:d6:85:6d:7d:cc:1d:29:42:a1:14:92:1b:6c:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a044753daa1d6856d7dcc1d2942a114921b6c74/; sid:903200030; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a8:c7:79:04:f3:e6:1e:6d:18:2d:7a:69:15:25:c4:09:ff:12:ef:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a8c77904f3e61e6d182d7a691525c409ff12ef86/; sid:903200031; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"44:c0:7a:2f:f9:9b:c1:10:e1:d8:d0:4e:c5:51:33:a6:3e:4d:67:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44c07a2ff99bc110e1d8d04ec55133a63e4d674c/; sid:903200032; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"66:5b:56:58:82:2a:40:6d:49:7c:f7:26:a1:45:4c:6e:2e:2f:b9:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/665b5658822a406d497cf726a1454c6e2e2fb913/; sid:903200033; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"c5:35:af:d2:43:74:e0:3f:73:9d:08:1d:0d:3c:f9:da:42:d5:83:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c535afd24374e03f739d081d0d3cf9da42d583ba/; sid:903200034; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"9d:28:3f:39:3e:ff:dc:af:fb:1a:65:1f:d1:bb:dc:3c:43:b5:44:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d283f393effdcaffb1a651fd1bbdc3c43b544eb/; sid:903200035; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a9:24:0e:12:4a:b9:4f:16:74:4d:54:c2:50:f2:df:46:1d:dc:39:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9240e124ab94f16744d54c250f2df461ddc392b/; sid:903200036; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"1e:88:57:08:ec:79:94:80:8f:1d:37:3d:2c:3a:c3:4d:2d:27:f5:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e885708ec7994808f1d373d2c3ac34d2d27f5de/; sid:903200037; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"72:ce:ed:55:39:c6:0f:e7:ef:db:c8:7e:77:7f:73:1c:75:d3:ff:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72ceed5539c60fe7efdbc87e777f731c75d3ffea/; sid:903200038; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"78:0e:3b:97:7f:c1:19:e7:a0:e1:cd:51:92:90:9b:a0:ba:95:c8:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/780e3b977fc119e7a0e1cd5192909ba0ba95c8c7/; sid:903200039; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"ab:16:63:e4:a6:cb:03:80:ed:98:bb:d5:71:5c:db:65:b2:d6:69:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab1663e4a6cb0380ed98bbd5715cdb65b2d669b8/; sid:903200040; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"9b:3f:d7:d4:0e:bb:5e:60:b1:c3:d7:59:83:b4:b7:56:c3:2e:95:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9b3fd7d40ebb5e60b1c3d75983b4b756c32e9560/; sid:903200041; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"3c:9a:92:56:40:3d:8a:27:7b:40:2f:d1:ac:d3:77:bf:33:1a:6d:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c9a9256403d8a277b402fd1acd377bf331a6d3b/; sid:903200042; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"13:33:31:6e:0c:e9:8c:e7:72:61:13:f8:da:52:1e:79:4c:a0:3f:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1333316e0ce98ce7726113f8da521e794ca03f9a/; sid:903200043; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7f:10:2b:cc:0a:6f:da:d4:d1:61:77:3b:aa:bb:08:43:17:3e:a7:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f102bcc0a6fdad4d161773baabb0843173ea76f/; sid:903200044; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"0b:b0:85:d5:61:df:07:c8:89:e5:ba:d5:1c:84:63:71:d4:fc:fd:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0bb085d561df07c889e5bad51c846371d4fcfd61/; sid:903200045; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"f1:e6:0b:d9:3b:0a:19:a6:39:9d:76:7e:10:7f:2d:02:ad:ac:d6:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f1e60bd93b0a19a6399d767e107f2d02adacd66a/; sid:903200046; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b4:91:37:1e:62:d5:4a:bf:94:22:59:e1:42:b0:26:55:34:0e:e6:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b491371e62d54abf942259e142b02655340ee663/; sid:903200047; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"97:a1:2f:da:4e:08:49:7e:fc:13:4e:81:03:92:12:fe:55:d7:7f:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97a12fda4e08497efc134e81039212fe55d77f21/; sid:903200048; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"70:13:79:68:5c:86:34:db:58:07:04:6b:49:71:ed:4c:8d:4d:7f:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/701379685c8634db5807046b4971ed4c8d4d7f31/; sid:903200049; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cb:cf:9e:26:9d:60:35:12:8c:95:36:04:10:97:13:b9:1e:50:7a:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cbcf9e269d6035128c953604109713b91e507a91/; sid:903200050; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"bc:08:3e:da:9c:3a:84:fa:bf:6d:39:23:7e:bb:7a:d8:65:54:0b:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc083eda9c3a84fabf6d39237ebb7ad865540b56/; sid:903200051; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoWall C&C)"; tls_cert_fingerprint; content:"a7:da:82:eb:15:e9:87:09:ba:62:5c:84:3d:bb:e7:ad:d3:24:6a:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a7da82eb15e98709ba625c843dbbe7add3246ac9/; sid:903200052; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"18:60:c1:1a:22:26:ba:9d:25:4b:5d:e2:57:31:97:be:9d:0c:66:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1860c11a2226ba9d254b5de2573197be9d0c6644/; sid:903200053; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoWall C&C)"; tls_cert_fingerprint; content:"0e:dd:72:24:52:c1:2c:68:6f:16:a7:ee:7b:e7:4b:56:e8:9a:6d:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0edd722452c12c686f16a7ee7be74b56e89a6db5/; sid:903200054; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f7:41:76:2e:a8:09:4a:8d:95:ad:84:ba:ea:0d:42:e8:0c:e5:84:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f741762ea8094a8d95ad84baea0d42e80ce584d0/; sid:903200055; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"19:56:b7:ff:84:f6:f8:41:f5:b5:8d:63:76:88:59:b6:d5:f0:3d:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1956b7ff84f6f841f5b58d63768859b6d5f03d3c/; sid:903200056; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"0b:2b:84:87:3f:70:64:d6:3e:52:74:14:45:4f:62:7d:c8:88:10:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b2b84873f7064d63e527414454f627dc8881006/; sid:903200057; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4f:b4:c8:1e:f5:c1:bf:0e:2e:53:3d:8c:46:63:40:67:a1:5f:25:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4fb4c81ef5c1bf0e2e533d8c46634067a15f25fe/; sid:903200058; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"df:d8:98:e9:2b:ea:e0:6c:3b:47:96:73:67:66:43:be:c4:33:19:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfd898e92beae06c3b479673676643bec433199f/; sid:903200059; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cb:fa:15:96:b1:8d:b5:57:d3:f1:a7:2d:0a:4f:67:eb:94:cb:98:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cbfa1596b18db557d3f1a72d0a4f67eb94cb98f7/; sid:903200060; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1a:3f:a8:f8:56:d4:da:64:83:f0:7b:29:40:41:cf:84:2e:b4:e9:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a3fa8f856d4da6483f07b294041cf842eb4e9b5/; sid:903200061; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ab:92:db:cc:12:05:45:36:1d:3a:cc:c5:50:d4:e5:79:67:d4:85:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab92dbcc120545361d3accc550d4e57967d48571/; sid:903200062; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"31:fa:8d:4f:b9:07:ed:28:21:94:b1:97:c0:49:d4:83:42:c2:60:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31fa8d4fb907ed282194b197c049d48342c26072/; sid:903200063; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6b:3e:3b:e7:be:8c:f3:83:bd:f4:b0:91:97:32:23:11:46:d6:b2:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b3e3be7be8cf383bdf4b0919732231146d6b28e/; sid:903200064; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c7:0e:2a:54:f2:e0:02:36:66:b9:5f:67:50:15:41:3a:a5:8e:58:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c70e2a54f2e0023666b95f675015413aa58e58f2/; sid:903200065; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5f:94:d5:8a:9c:98:ce:49:48:55:e6:bf:4f:a2:0c:e9:d7:69:8a:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f94d58a9c98ce494855e6bf4fa20ce9d7698a3e/; sid:903200066; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c9:b0:97:d6:2d:6f:7b:36:5f:88:fc:ec:1d:a9:4d:ed:5e:d9:32:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9b097d62d6f7b365f88fcec1da94ded5ed9321f/; sid:903200067; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"57:1f:c6:e9:d1:fc:25:e1:c0:16:a4:8c:fa:68:d0:90:1c:ef:9f:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/571fc6e9d1fc25e1c016a48cfa68d0901cef9f77/; sid:903200068; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"9d:5f:4b:bd:00:81:77:0e:67:43:31:e9:a0:db:e7:45:c9:85:e8:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d5f4bbd0081770e674331e9a0dbe745c985e850/; sid:903200069; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fa:a4:0c:d8:5f:e4:f3:14:36:37:d4:37:2d:fb:ae:ad:0a:24:26:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/faa40cd85fe4f3143637d4372dfbaead0a242688/; sid:903200070; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"82:c0:1d:a1:b8:8b:9f:3a:1c:ea:2e:04:47:90:71:10:ea:80:24:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/82c01da1b88b9f3a1cea2e0447907110ea8024c6/; sid:903200071; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"80:ec:69:70:97:91:51:ca:e8:3c:e1:a4:1e:26:40:d8:9e:c7:46:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80ec6970979151cae83ce1a41e2640d89ec746d1/; sid:903200072; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8b:d3:8c:0a:32:1d:b5:52:7f:59:de:d4:8e:b0:11:ba:7e:a6:93:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8bd38c0a321db5527f59ded48eb011ba7ea69365/; sid:903200073; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"3f:b1:8e:1a:73:74:f2:c2:4b:4e:40:44:14:d1:c0:93:93:5d:d7:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3fb18e1a7374f2c24b4e404414d1c093935dd724/; sid:903200074; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"34:8e:8f:a3:05:d8:b1:e5:fe:d5:3c:07:1e:dd:58:e7:a0:c9:d9:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/348e8fa305d8b1e5fed53c071edd58e7a0c9d9d4/; sid:903200075; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"0b:f5:47:c6:01:50:59:da:bb:10:f7:af:8f:e3:88:e3:14:bd:fa:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0bf547c6015059dabb10f7af8fe388e314bdfada/; sid:903200076; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"64:44:0f:f2:d7:a0:bf:97:9d:47:8a:93:3a:ab:00:a6:87:4f:17:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64440ff2d7a0bf979d478a933aab00a6874f1762/; sid:903200077; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c6:18:bb:b6:68:fb:c1:d8:3e:b7:d5:b7:ae:c7:c6:d6:95:7b:2f:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c618bbb668fbc1d83eb7d5b7aec7c6d6957b2f16/; sid:903200078; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"97:af:5c:c8:e7:27:96:f4:fa:e4:87:04:45:36:95:8a:8c:6d:68:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97af5cc8e72796f4fae487044536958a8c6d68f6/; sid:903200079; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5b:24:18:9a:79:a3:96:2d:a8:89:a2:e8:f9:cb:33:73:83:c2:0e:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b24189a79a3962da889a2e8f9cb337383c20e95/; sid:903200080; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"b0:03:44:3e:f1:2b:5f:f4:4b:5a:00:a2:68:d2:09:5b:43:d2:a8:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b003443ef12b5ff44b5a00a268d2095b43d2a86f/; sid:903200081; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"20:9a:83:7a:36:8b:be:a8:83:bc:b8:d5:79:8c:24:74:8c:41:b8:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/209a837a368bbea883bcb8d5798c24748c41b8e4/; sid:903200082; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"74:06:45:7d:94:2e:bc:79:e4:91:45:4c:d5:7d:fc:f9:bc:c8:95:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7406457d942ebc79e491454cd57dfcf9bcc895af/; sid:903200083; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"1b:cc:ac:6e:7f:39:5c:5a:30:c6:ec:51:b8:fa:05:5a:64:1a:0d:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1bccac6e7f395c5a30c6ec51b8fa055a641a0d68/; sid:903200084; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"4b:1d:64:c1:63:7a:ae:42:7a:a0:7d:6c:75:6c:13:b9:77:71:56:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4b1d64c1637aae427aa07d6c756c13b977715603/; sid:903200085; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"f9:86:e8:fa:b5:55:bb:db:96:9f:f2:4c:48:8c:d9:66:09:43:5e:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f986e8fab555bbdb969ff24c488cd96609435eec/; sid:903200086; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"6a:ec:d8:4a:d1:ab:ba:45:cb:2d:bb:6f:26:59:bd:78:bf:5a:88:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6aecd84ad1abba45cb2dbb6f2659bd78bf5a88b2/; sid:903200087; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"86:bc:a8:33:e8:c2:80:56:25:a0:b9:0a:0f:ac:c4:5c:7f:19:8f:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86bca833e8c2805625a0b90a0facc45c7f198f56/; sid:903200088; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"2e:14:0f:07:4b:ff:ad:e9:c9:20:7e:3c:60:d2:7b:27:16:fe:6a:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e140f074bffade9c9207e3c60d27b2716fe6a63/; sid:903200089; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f5:e2:b6:7a:1e:92:49:ab:ac:d0:4f:68:36:9b:2a:0d:fb:0b:4f:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5e2b67a1e9249abacd04f68369b2a0dfb0b4fd7/; sid:903200090; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"59:c1:d3:55:1c:d5:43:55:39:10:72:03:0d:21:57:7a:c6:5a:49:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59c1d3551cd54355391072030d21577ac65a4983/; sid:903200091; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cb:f6:8e:89:9c:14:cd:be:d2:5b:20:d3:98:ce:67:24:d6:0d:e0:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cbf68e899c14cdbed25b20d398ce6724d60de0a6/; sid:903200092; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c8:7e:eb:70:75:75:e5:23:8d:77:73:10:2d:f1:73:07:2a:bb:bf:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c87eeb707575e5238d7773102df173072abbbf0b/; sid:903200093; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"df:9c:32:dd:ba:0b:e9:6f:08:52:bc:59:3d:a3:d7:82:12:b1:d5:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/df9c32ddba0be96f0852bc593da3d78212b1d545/; sid:903200094; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4d:0f:1f:0f:96:85:ef:f1:24:e5:6a:31:19:2a:2b:ea:e7:88:d8:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d0f1f0f9685eff124e56a31192a2beae788d88b/; sid:903200095; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"18:d2:a1:63:f6:7d:6e:cb:68:fa:e4:3c:53:72:6b:4c:75:41:dd:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18d2a163f67d6ecb68fae43c53726b4c7541dda4/; sid:903200096; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b7:5e:ae:2b:4f:10:69:d4:c5:a4:02:e8:77:d6:2d:39:78:2d:1e:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b75eae2b4f1069d4c5a402e877d62d39782d1e17/; sid:903200097; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"97:69:f3:1a:c0:43:0f:24:d9:71:db:5d:02:2a:f0:56:83:f1:78:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9769f31ac0430f24d971db5d022af05683f178a4/; sid:903200098; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"03:1b:9a:b1:15:b9:23:06:f8:ab:ee:8f:bb:42:20:d2:86:cf:44:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/031b9ab115b92306f8abee8fbb4220d286cf4497/; sid:903200099; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d7:b1:19:96:6c:5b:41:dd:99:b2:e1:e1:c8:74:5f:cb:65:f8:09:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7b119966c5b41dd99b2e1e1c8745fcb65f809de/; sid:903200100; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4e:ac:f7:ce:46:3d:ff:ae:b2:40:cb:d9:7a:09:f0:dd:42:08:e7:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4eacf7ce463dffaeb240cbd97a09f0dd4208e748/; sid:903200101; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"df:4b:2f:32:9f:19:f8:a5:02:33:e4:f5:1e:e1:61:6e:b8:0d:c7:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/df4b2f329f19f8a50233e4f51ee1616eb80dc7f1/; sid:903200102; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"51:4c:27:56:06:f0:49:1b:66:00:89:2c:7e:52:78:52:d9:43:2c:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/514c275606f0491b6600892c7e527852d9432c2d/; sid:903200103; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"a3:2f:a1:ea:3b:5d:64:a3:5d:22:b0:58:9d:14:e6:c3:ce:60:8b:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a32fa1ea3b5d64a35d22b0589d14e6c3ce608b27/; sid:903200104; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"1c:1c:14:19:08:30:be:d5:ba:8a:f1:24:5c:f1:cb:d7:31:3b:bf:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c1c14190830bed5ba8af1245cf1cbd7313bbf3f/; sid:903200105; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"9e:da:7e:5c:c4:e1:cb:c0:b5:21:3f:bb:71:82:2c:f9:57:4d:fc:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9eda7e5cc4e1cbc0b5213fbb71822cf9574dfc63/; sid:903200106; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"ba:e6:e4:56:b7:23:9d:2e:01:cd:2a:bb:6a:10:13:9d:96:3c:73:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bae6e456b7239d2e01cd2abb6a10139d963c7314/; sid:903200107; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4c:1c:1a:aa:58:80:31:74:58:79:8a:04:db:76:42:8e:ce:55:f1:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c1c1aaa5880317458798a04db76428ece55f140/; sid:903200108; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"25:c3:39:6d:47:d5:df:12:fa:af:dd:06:68:7e:7e:69:f8:fc:6f:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25c3396d47d5df12faafdd06687e7e69f8fc6fe8/; sid:903200109; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"d7:55:96:ad:b6:04:92:05:42:0f:f5:ae:8e:67:1c:45:c7:3e:42:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d75596adb6049205420ff5ae8e671c45c73e42b2/; sid:903200110; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"eb:84:13:3c:89:78:54:1c:09:ac:e6:04:47:28:e6:21:ad:d3:07:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb84133c8978541c09ace6044728e621add30726/; sid:903200111; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7e:07:b1:ff:c2:4b:29:5e:e8:07:12:4f:79:ff:43:db:53:cf:d8:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e07b1ffc24b295ee807124f79ff43db53cfd885/; sid:903200112; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e1:8a:83:80:94:9a:ec:89:30:5d:f7:b6:ee:4b:00:07:af:30:52:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e18a8380949aec89305df7b6ee4b0007af3052d3/; sid:903200113; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fc:17:8b:e5:34:0e:49:c4:27:78:f3:63:5a:6d:28:9c:a2:24:48:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc178be5340e49c42778f3635a6d289ca22448db/; sid:903200114; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"80:ac:8f:7c:a8:c6:dd:1b:5b:23:17:63:e9:09:50:52:40:a9:d1:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80ac8f7ca8c6dd1b5b231763e909505240a9d1a6/; sid:903200115; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"36:ae:19:7c:21:ca:c2:56:0f:6d:6e:dc:a5:0c:46:3e:a0:49:f1:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/36ae197c21cac2560f6d6edca50c463ea049f152/; sid:903200116; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"46:de:ba:70:b2:f5:e1:7b:a8:54:cf:02:26:ec:5b:df:8f:b0:06:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46deba70b2f5e17ba854cf0226ec5bdf8fb0067b/; sid:903200117; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"0e:03:44:08:34:6e:2c:66:fa:ec:a8:f8:97:24:ea:1f:f6:c7:5a:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e034408346e2c66faeca8f89724ea1ff6c75a5e/; sid:903200118; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"b2:1e:b5:fc:2f:3a:a1:1e:5d:9f:f6:43:a5:b3:c2:ce:70:f8:b2:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b21eb5fc2f3aa11e5d9ff643a5b3c2ce70f8b250/; sid:903200119; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1f:02:e5:25:13:04:15:32:61:96:c9:a3:94:65:58:d6:62:fe:8c:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f02e525130415326196c9a3946558d662fe8cbd/; sid:903200120; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"72:38:82:27:58:be:10:e5:44:50:75:20:03:53:12:21:5d:b4:04:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7238822758be10e544507520035312215db40460/; sid:903200121; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"b6:02:85:17:c1:0f:e9:e3:10:48:f0:2e:58:53:e5:c1:74:1f:ef:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6028517c10fe9e31048f02e5853e5c1741fefb8/; sid:903200122; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"e8:52:a3:e8:cd:0b:eb:2d:28:df:62:2e:2c:a4:d5:4d:f4:3c:cc:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e852a3e8cd0beb2d28df622e2ca4d54df43ccc9f/; sid:903200123; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"dd:bd:80:27:40:3b:bd:f2:17:e6:34:53:0b:ee:72:40:ce:d6:8a:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddbd8027403bbdf217e634530bee7240ced68a8e/; sid:903200124; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"ff:15:52:d1:df:5c:d0:0e:c5:69:00:31:9e:9f:24:80:4a:e6:0c:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff1552d1df5cd00ec56900319e9f24804ae60c63/; sid:903200125; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"61:f6:0a:65:b6:1a:5b:e7:b3:18:69:54:eb:cf:89:ba:2c:0e:a9:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/61f60a65b61a5be7b3186954ebcf89ba2c0ea963/; sid:903200126; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"3e:94:59:33:e9:ee:8b:33:04:ee:2c:9b:f9:06:87:a4:31:68:5c:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e945933e9ee8b3304ee2c9bf90687a431685c3b/; sid:903200127; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"91:da:28:13:75:73:71:33:e7:6b:4a:02:f6:dc:56:ff:41:da:69:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91da281375737133e76b4a02f6dc56ff41da6936/; sid:903200128; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"3b:5b:76:80:24:3d:3e:09:49:a7:f8:fc:59:72:2b:b5:37:be:cb:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b5b7680243d3e0949a7f8fc59722bb537becbb5/; sid:903200129; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"09:f0:c1:86:37:73:63:98:2c:19:7a:ed:2a:ca:60:2d:ce:4f:cf:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09f0c186377363982c197aed2aca602dce4fcf16/; sid:903200130; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"43:cb:f3:ff:69:9b:3d:dc:58:29:17:bd:ff:41:ed:59:13:c7:39:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43cbf3ff699b3ddc582917bdff41ed5913c7398a/; sid:903200131; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4e:c9:74:44:8f:e0:4a:b3:69:7a:c7:08:cc:65:42:ef:d4:b3:e4:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ec974448fe04ab3697ac708cc6542efd4b3e46c/; sid:903200132; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"82:e2:15:a9:6a:60:b2:ef:fd:68:d8:9c:35:e4:ae:f0:f8:ca:63:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/82e215a96a60b2effd68d89c35e4aef0f8ca6349/; sid:903200133; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"be:1a:58:4a:85:c8:79:f8:55:5d:98:4f:c3:6b:ef:69:db:6d:8a:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be1a584a85c879f8555d984fc36bef69db6d8ad5/; sid:903200134; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"27:fc:1e:59:18:1f:38:78:8c:49:87:08:6c:33:38:c1:af:10:78:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27fc1e59181f38788c4987086c3338c1af107820/; sid:903200135; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"85:a8:d8:0b:16:83:29:3a:8d:3a:24:94:e0:45:e1:e4:44:f5:ed:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85a8d80b1683293a8d3a2494e045e1e444f5edd3/; sid:903200136; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fc:8e:82:09:ef:08:ca:4a:66:d1:f5:04:5a:2e:21:0c:28:d6:14:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc8e8209ef08ca4a66d1f5045a2e210c28d61493/; sid:903200137; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"75:02:e5:5d:eb:4d:19:b9:6e:a9:61:26:34:82:4b:2f:b6:ad:96:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7502e55deb4d19b96ea9612634824b2fb6ad966d/; sid:903200138; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fc:0b:6f:b8:e2:b3:b6:38:9f:4c:c2:a8:43:0a:bd:24:32:8f:03:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc0b6fb8e2b3b6389f4cc2a8430abd24328f03fb/; sid:903200139; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d4:86:1e:9b:06:e0:7d:34:ad:12:5d:88:03:c4:61:a6:a7:a3:7e:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4861e9b06e07d34ad125d8803c461a6a7a37e21/; sid:903200140; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cf:7d:c0:ae:08:ac:82:ca:c3:0a:fc:c9:a7:66:d7:b4:7a:b8:ab:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf7dc0ae08ac82cac30afcc9a766d7b47ab8abfe/; sid:903200141; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"10:ea:24:97:d8:fa:21:b8:12:5b:da:72:0c:98:c4:79:9c:f2:16:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10ea2497d8fa21b8125bda720c98c4799cf21624/; sid:903200142; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"87:92:e6:87:41:47:f5:3b:4b:6d:f6:d5:2d:ba:7d:dd:56:bf:24:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8792e6874147f53b4b6df6d52dba7ddd56bf2464/; sid:903200143; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (URLzone C&C)"; tls_cert_fingerprint; content:"d7:fe:8e:b3:8b:ab:d3:4e:3e:f8:47:12:e7:2f:87:35:e7:74:fd:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7fe8eb38babd34e3ef84712e72f8735e774fdcf/; sid:903200144; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1e:0f:3d:14:42:f9:52:2b:24:25:15:cb:69:68:a1:0b:08:f4:85:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e0f3d1442f9522b242515cb6968a10b08f4857c/; sid:903200145; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a9:2a:fb:a1:2b:15:14:3b:09:0d:cd:83:2f:60:a9:88:79:fa:30:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a92afba12b15143b090dcd832f60a98879fa30dd/; sid:903200146; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"47:46:41:98:fc:47:5a:2e:a1:76:18:38:b1:f8:0d:ea:e7:99:d0:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/47464198fc475a2ea1761838b1f80deae799d05f/; sid:903200147; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS MITM)"; tls_cert_fingerprint; content:"b6:d7:85:2a:e1:ca:32:5f:77:28:d4:64:12:44:8b:01:41:94:0b:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6d7852ae1ca325f7728d46412448b0141940bc9/; sid:903200148; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cd:bc:8b:c2:e9:63:ee:6c:e5:18:e0:6a:92:42:a5:4a:28:19:eb:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cdbc8bc2e963ee6ce518e06a9242a54a2819eb7f/; sid:903200149; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ca:82:6a:ae:ef:5b:98:45:fe:bb:18:ca:45:05:25:3b:12:76:95:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca826aaeef5b9845febb18ca4505253b127695b7/; sid:903200150; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Spambot C&C)"; tls_cert_fingerprint; content:"05:9e:0e:19:e3:67:bd:56:67:24:ae:49:6d:fa:73:47:84:6b:b8:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/059e0e19e367bd566724ae496dfa7347846bb8e6/; sid:903200151; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (URLzone C&C)"; tls_cert_fingerprint; content:"50:ad:f0:20:3f:3d:91:02:a6:42:48:19:ea:36:e4:dd:5e:38:02:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50adf0203f3d9102a6424819ea36e4dd5e38025a/; sid:903200152; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cf:65:71:b1:92:56:0b:27:33:a9:03:8d:b2:e1:bb:aa:5b:1a:77:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf6571b192560b2733a9038db2e1bbaa5b1a77f3/; sid:903200153; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e7:d7:8b:56:b7:93:4e:74:fb:77:b4:73:e5:40:7d:40:d4:08:3c:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7d78b56b7934e74fb77b473e5407d40d4083c19/; sid:903200154; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"bd:4b:79:f7:da:d6:cb:0c:08:25:59:af:02:5b:e1:ef:89:ca:65:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bd4b79f7dad6cb0c082559af025be1ef89ca6548/; sid:903200155; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8f:37:76:15:40:99:b6:c2:dc:34:b8:c3:7f:f5:21:17:21:44:a9:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f3776154099b6c2dc34b8c37ff521172144a9a4/; sid:903200156; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c2:31:55:e7:15:34:ff:5b:1d:cb:09:a5:97:91:47:ee:7f:ea:14:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c23155e71534ff5b1dcb09a5979147ee7fea1461/; sid:903200157; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"84:69:75:0b:a5:9f:d8:26:17:49:d7:af:6e:7f:a1:ad:c9:d3:4c:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8469750ba59fd8261749d7af6e7fa1adc9d34cbd/; sid:903200158; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c9:ad:5c:d2:87:7f:35:4f:75:d5:d4:2b:56:4c:ab:a8:0f:70:5e:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9ad5cd2877f354f75d5d42b564caba80f705e7d/; sid:903200159; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"ea:ab:3c:a3:76:94:c8:9d:57:b9:21:b4:f3:93:0b:af:de:02:2d:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eaab3ca37694c89d57b921b4f3930bafde022de0/; sid:903200160; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"ca:2e:43:5b:b8:83:60:81:ff:a6:1c:90:2d:b0:5a:4e:0e:11:c7:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca2e435bb8836081ffa61c902db05a4e0e11c78f/; sid:903200161; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e5:0e:e9:90:a3:12:b9:e2:e6:8c:46:d1:89:e1:e9:23:81:74:1b:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e50ee990a312b9e2e68c46d189e1e92381741bf9/; sid:903200162; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e6:d3:0c:d0:41:d1:9d:3a:3e:9c:82:e0:b9:e3:e1:67:ad:0f:ee:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e6d30cd041d19d3a3e9c82e0b9e3e167ad0fee9f/; sid:903200163; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"88:c0:22:bd:88:75:be:b6:43:9a:c1:d8:be:85:92:e1:3e:f3:d9:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88c022bd8875beb6439ac1d8be8592e13ef3d918/; sid:903200164; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7e:57:f5:17:78:61:4c:bb:57:2d:28:fb:a2:45:b8:7d:0b:c5:f9:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e57f51778614cbb572d28fba245b87d0bc5f9b3/; sid:903200165; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b5:ff:48:e0:d2:15:2e:04:83:f1:8d:50:60:41:46:7a:55:d1:fb:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5ff48e0d2152e0483f18d506041467a55d1fba8/; sid:903200166; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoWall C&C)"; tls_cert_fingerprint; content:"a8:5e:b1:7f:49:8c:6f:5e:b4:bb:a8:06:70:76:6a:af:c3:06:06:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a85eb17f498c6f5eb4bba80670766aafc3060600/; sid:903200167; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"48:30:df:5d:da:22:0b:59:6e:13:31:62:14:74:ba:89:fb:aa:5f:81"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4830df5dda220b596e1331621474ba89fbaa5f81/; sid:903200168; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"35:66:21:93:91:b9:56:61:88:b4:c8:02:1e:a3:eb:c6:1c:97:35:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3566219391b9566188b4c8021ea3ebc61c9735c3/; sid:903200169; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoWall C&C)"; tls_cert_fingerprint; content:"29:4f:53:c0:1b:59:8d:6f:3e:e9:63:e9:c0:1f:3d:b9:86:1b:f7:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/294f53c01b598d6f3ee963e9c01f3db9861bf7bc/; sid:903200170; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"94:f1:27:e6:45:d4:a5:7e:4d:7d:33:bc:a0:26:4e:55:73:d1:5e:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94f127e645d4a57e4d7d33bca0264e5573d15ee1/; sid:903200171; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS MITM)"; tls_cert_fingerprint; content:"c0:9a:e4:8d:fd:b9:86:cb:c3:4a:09:6d:3e:b3:68:e0:ae:4c:d5:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c09ae48dfdb986cbc34a096d3eb368e0ae4cd521/; sid:903200172; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoWall C&C)"; tls_cert_fingerprint; content:"c3:c4:d6:15:60:0a:da:76:d5:90:85:96:71:d2:f2:26:a9:a9:5f:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3c4d615600ada76d590859671d2f226a9a95fde/; sid:903200173; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"bc:c8:b2:e2:01:8c:e5:13:88:79:75:1b:d0:06:53:a8:c2:7f:1c:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bcc8b2e2018ce5138879751bd00653a8c27f1c48/; sid:903200174; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak MITM)"; tls_cert_fingerprint; content:"33:ec:b0:cd:e6:59:8b:79:f9:82:a3:7a:eb:54:fe:e0:f1:d1:d1:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33ecb0cde6598b79f982a37aeb54fee0f1d1d173/; sid:903200175; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"99:f9:f7:e5:71:8c:4d:46:76:e3:b3:8c:a1:bd:5d:bc:ed:b6:9f:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99f9f7e5718c4d4676e3b38ca1bd5dbcedb69f61/; sid:903200176; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d1:37:10:8c:b2:4d:52:6f:6c:17:7c:9c:bb:a7:f0:e5:56:ac:27:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d137108cb24d526f6c177c9cbba7f0e556ac273c/; sid:903200177; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1a:b3:3d:50:41:e4:17:65:09:92:3d:12:12:13:33:43:86:04:27:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ab33d5041e4176509923d1212133343860427b3/; sid:903200178; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f6:fc:60:88:f9:49:b3:41:f4:72:e1:52:d7:18:20:af:45:ea:8b:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f6fc6088f949b341f472e152d71820af45ea8b6b/; sid:903200179; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"16:7a:cd:80:68:09:e5:ea:36:a0:26:73:39:30:f2:d7:6a:82:41:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/167acd806809e5ea36a026733930f2d76a824113/; sid:903200180; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b7:dc:f4:08:fd:ca:09:4d:d1:7f:5b:ae:03:fc:9b:b8:46:6f:51:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b7dcf408fdca094dd17f5bae03fc9bb8466f51dc/; sid:903200181; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"39:0d:c2:b0:5f:3a:bb:70:68:a1:0d:f8:d3:0f:fc:d3:3b:34:c3:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/390dc2b05f3abb7068a10df8d30ffcd33b34c3e3/; sid:903200182; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c1:a1:e8:71:a0:86:a3:12:33:a1:7d:24:ae:4c:fd:89:fa:76:18:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1a1e871a086a31233a17d24ae4cfd89fa7618ef/; sid:903200183; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"68:ee:30:19:4f:35:b7:93:68:82:ba:b1:2d:f5:98:11:d7:55:3c:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68ee30194f35b7936882bab12df59811d7553cd4/; sid:903200184; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5e:33:7a:b1:cc:16:d9:bf:3a:76:be:37:ec:09:27:ba:ad:25:6f:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e337ab1cc16d9bf3a76be37ec0927baad256f26/; sid:903200185; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"24:42:9c:6f:ec:f2:c9:25:b9:96:ab:0a:bb:db:7e:2c:92:be:0c:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24429c6fecf2c925b996ab0abbdb7e2c92be0c9c/; sid:903200186; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"78:8d:24:64:0f:a0:77:f2:22:66:21:98:43:b2:fa:85:1b:58:5e:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/788d24640fa077f22266219843b2fa851b585e9b/; sid:903200187; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"35:4f:08:df:b9:fe:a2:e2:42:3d:c7:62:ea:09:66:56:ae:b1:25:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/354f08dfb9fea2e2423dc762ea096656aeb12551/; sid:903200188; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1f:3f:e6:90:29:e8:0d:06:70:de:01:55:2e:86:0a:2d:b9:b3:76:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f3fe69029e80d0670de01552e860a2db9b37684/; sid:903200189; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"41:f2:38:2b:b2:12:a3:43:cc:99:2f:70:c0:f1:de:97:e8:6b:4c:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/41f2382bb212a343cc992f70c0f1de97e86b4c0b/; sid:903200190; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b2:b3:a1:fc:d2:30:1f:0c:e0:4c:ea:0a:b7:0e:30:68:87:9e:fc:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2b3a1fcd2301f0ce04cea0ab70e3068879efcb6/; sid:903200191; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"94:93:54:e6:f4:5d:8f:56:7e:0f:a8:32:20:40:e9:c2:9e:30:b2:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/949354e6f45d8f567e0fa8322040e9c29e30b271/; sid:903200192; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"4c:0c:eb:09:14:d9:3e:a8:57:05:46:0e:cd:77:2d:86:5b:cb:a3:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c0ceb0914d93ea85705460ecd772d865bcba3a1/; sid:903200193; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"62:f7:1c:f2:b7:a4:d2:16:cb:04:1f:10:bf:43:7d:00:93:35:8b:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62f71cf2b7a4d216cb041f10bf437d0093358be1/; sid:903200194; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"0b:47:b3:c4:1b:3f:19:b0:ba:79:fc:5f:ca:b0:ce:81:40:2e:00:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b47b3c41b3f19b0ba79fc5fcab0ce81402e0030/; sid:903200195; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"62:ac:62:8d:4c:ca:f8:5d:b9:18:43:cf:30:ca:cb:2d:66:52:f3:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62ac628d4ccaf85db91843cf30cacb2d6652f3d6/; sid:903200196; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"77:61:9e:10:35:ec:37:9d:9c:3b:76:eb:dd:61:fc:ca:37:13:ce:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77619e1035ec379d9c3b76ebdd61fcca3713ce84/; sid:903200197; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"9e:77:fb:7a:5f:9c:9d:cc:bc:4e:ec:f6:b6:6f:91:1f:52:5a:01:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e77fb7a5f9c9dccbc4eecf6b66f911f525a010c/; sid:903200198; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"26:b9:b5:66:44:16:b5:6e:8f:61:71:78:3b:e8:1c:af:b4:11:b8:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26b9b5664416b56e8f6171783be81cafb411b8e3/; sid:903200199; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"79:44:a3:49:39:ef:b5:ae:88:26:dc:51:af:2b:1d:9f:3d:b4:10:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7944a34939efb5ae8826dc51af2b1d9f3db4105b/; sid:903200200; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e4:03:8d:79:c9:89:9d:58:46:bb:96:b8:b1:61:5a:c6:a1:28:c8:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e4038d79c9899d5846bb96b8b1615ac6a128c86c/; sid:903200201; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a0:ce:c9:60:51:5d:32:4a:34:97:05:5b:e2:6e:f1:67:7d:95:a4:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a0cec960515d324a3497055be26ef1677d95a4f0/; sid:903200202; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f9:98:72:4c:aa:ff:a6:65:43:e2:85:0f:52:5e:af:19:1e:af:1d:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f998724caaffa66543e2850f525eaf191eaf1d47/; sid:903200203; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7f:fc:cb:88:7e:7f:10:c3:f6:bf:43:73:6e:a8:6d:1a:91:f4:a3:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7ffccb887e7f10c3f6bf43736ea86d1a91f4a3e8/; sid:903200204; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"2b:14:02:a1:75:37:d4:5d:ab:39:cf:c1:24:17:3d:77:65:0a:77:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b1402a17537d45dab39cfc124173d77650a772c/; sid:903200205; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"90:9f:c2:97:de:60:76:2b:f4:86:7b:d2:7b:f6:4c:0a:cf:91:4c:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/909fc297de60762bf4867bd27bf64c0acf914c97/; sid:903200206; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d5:df:6e:cb:23:0a:6c:3e:80:a8:41:21:b6:67:c6:99:6e:49:d1:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d5df6ecb230a6c3e80a84121b667c6996e49d18a/; sid:903200207; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f1:53:3c:0e:c8:44:fa:de:12:8d:25:76:9d:ad:0c:a8:2e:d3:38:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f1533c0ec844fade128d25769dad0ca82ed338bd/; sid:903200208; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"9b:c8:51:4e:8c:b8:00:28:58:00:51:9a:b3:a7:de:05:8f:c7:46:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9bc8514e8cb800285800519ab3a7de058fc7466b/; sid:903200209; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ca:fb:35:4d:e9:5a:9a:72:53:e0:cd:fe:80:78:e2:4d:8f:73:a1:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cafb354de95a9a7253e0cdfe8078e24d8f73a167/; sid:903200210; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7f:68:5a:e4:16:ef:ef:9d:65:28:a6:80:b1:ac:a6:69:9f:12:f4:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f685ae416efef9d6528a680b1aca6699f12f484/; sid:903200211; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"94:9b:65:50:47:44:fe:bf:f8:20:37:4f:89:a2:a8:33:b5:4e:c6:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/949b65504744febff820374f89a2a833b54ec611/; sid:903200212; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"2e:09:6e:b5:5c:49:ac:90:70:fc:20:38:c3:c0:2a:62:6f:47:2f:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e096eb55c49ac9070fc2038c3c02a626f472fdb/; sid:903200213; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ed:08:7e:5e:8b:6e:e0:8c:50:a2:0b:0b:35:75:f1:bd:c1:ca:59:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed087e5e8b6ee08c50a20b0b3575f1bdc1ca59f5/; sid:903200214; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"66:f7:34:5d:67:18:f2:54:83:4d:75:29:87:8f:58:e2:d3:dd:b4:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66f7345d6718f254834d7529878f58e2d3ddb431/; sid:903200215; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"2d:dc:4c:0d:f2:4e:e9:54:df:fe:62:d7:9b:a4:ff:5f:98:6b:c6:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2ddc4c0df24ee954dffe62d79ba4ff5f986bc691/; sid:903200216; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ed:65:2d:41:0d:5b:d7:26:34:fc:26:60:98:2e:d2:da:16:94:d4:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed652d410d5bd72634fc2660982ed2da1694d4b5/; sid:903200217; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"57:d2:8c:a6:b5:58:44:40:fb:f1:fe:be:87:62:e7:72:3b:f1:1e:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/57d28ca6b5584440fbf1febe8762e7723bf11e8c/; sid:903200218; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"74:ab:9c:e7:9f:5a:fd:bd:64:04:6a:11:cd:34:ae:41:41:82:2b:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/74ab9ce79f5afdbd64046a11cd34ae4141822bda/; sid:903200219; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"aa:d0:d8:ff:51:db:fc:07:03:21:57:e3:e0:52:16:da:9e:7c:b5:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aad0d8ff51dbfc07032157e3e05216da9e7cb5b2/; sid:903200220; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"81:57:cb:4b:e0:60:29:34:ce:30:2e:d0:6f:47:9e:28:ff:37:f3:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8157cb4be0602934ce302ed06f479e28ff37f3d6/; sid:903200221; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8a:3e:a6:27:9a:7f:8e:40:e9:e2:23:b7:46:a3:5b:52:a3:f3:6d:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a3ea6279a7f8e40e9e223b746a35b52a3f36ddd/; sid:903200222; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"58:f2:71:bd:58:7f:8e:0e:25:94:76:9e:e8:43:5b:49:d2:f8:ef:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/58f271bd587f8e0e2594769ee8435b49d2f8ef5a/; sid:903200223; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b8:19:21:1e:7a:69:3e:6e:01:6d:f5:c8:de:60:44:9e:b3:56:85:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b819211e7a693e6e016df5c8de60449eb3568578/; sid:903200224; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"88:b6:12:28:95:2b:f3:ad:1e:59:7f:de:77:be:8a:66:75:d3:c5:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88b61228952bf3ad1e597fde77be8a6675d3c508/; sid:903200225; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f2:25:e3:43:f0:0e:fe:c2:91:51:5b:68:b0:47:db:70:51:95:20:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f225e343f00efec291515b68b047db70519520bd/; sid:903200226; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Teslacrypt C&C)"; tls_cert_fingerprint; content:"3b:f9:3e:ff:d4:77:a7:26:e6:6d:39:23:f0:c8:09:ad:c6:b6:88:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3bf93effd477a726e66d3923f0c809adc6b688e2/; sid:903200227; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ff:e3:9a:de:1d:93:16:9a:5f:3d:17:ee:98:00:df:8f:c5:4d:05:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ffe39ade1d93169a5f3d17ee9800df8fc54d05da/; sid:903200228; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"88:de:16:f4:4a:04:d2:f6:7a:3b:1e:81:17:2f:d8:2b:85:0e:71:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88de16f44a04d2f67a3b1e81172fd82b850e713c/; sid:903200229; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d8:24:30:44:55:4c:90:e8:d9:4e:70:ec:9c:8a:10:7f:69:f3:8c:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8243044554c90e8d94e70ec9c8a107f69f38c00/; sid:903200230; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"30:34:80:f0:3a:f1:31:12:cb:a9:7d:26:bd:99:96:e2:2e:0a:9d:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/303480f03af13112cba97d26bd9996e22e0a9d78/; sid:903200231; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c1:d9:ae:76:42:7e:ae:cd:c5:23:12:6a:1e:2d:20:33:59:22:b1:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1d9ae76427eaecdc523126a1e2d20335922b154/; sid:903200232; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"73:b1:ac:5c:4d:9d:a2:75:34:29:c7:58:f3:44:c2:7b:de:9f:3c:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73b1ac5c4d9da2753429c758f344c27bde9f3c25/; sid:903200233; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6c:e2:4d:b4:58:6c:48:8b:9c:29:f9:a2:a7:b6:0d:a1:0c:3e:12:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ce24db4586c488b9c29f9a2a7b60da10c3e1272/; sid:903200234; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"ec:e4:29:41:d0:04:48:37:9d:a1:2b:f1:e5:32:f3:b9:68:d2:8e:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ece42941d00448379da12bf1e532f3b968d28e95/; sid:903200235; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"69:9e:18:50:23:1b:ae:b2:e5:87:10:54:f4:e1:93:f1:e2:61:c7:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/699e1850231baeb2e5871054f4e193f1e261c7b3/; sid:903200236; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ef:94:f0:54:98:c7:bf:ac:aa:f3:74:56:68:70:32:cb:2b:01:82:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef94f05498c7bfacaaf37456687032cb2b018238/; sid:903200237; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b0:00:80:d0:04:ca:5f:05:81:38:32:a2:2c:44:25:21:bf:58:ff:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b00080d004ca5f05813832a22c442521bf58ff0b/; sid:903200238; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fe:22:69:6e:02:28:f9:1a:5a:fe:da:78:7a:df:22:ab:cf:49:61:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe22696e0228f91a5afeda787adf22abcf4961e8/; sid:903200239; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8d:62:41:2c:9c:23:03:a4:73:e6:cc:e7:2b:94:38:f0:40:5e:36:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d62412c9c2303a473e6cce72b9438f0405e36e3/; sid:903200240; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"0e:22:5c:f9:41:fd:1e:7b:e0:f5:e9:fe:21:dd:13:c3:73:10:0e:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e225cf941fd1e7be0f5e9fe21dd13c373100e44/; sid:903200241; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Upatre C&C)"; tls_cert_fingerprint; content:"0e:e1:e1:9b:75:5a:24:f4:97:e4:5b:e3:08:60:84:13:ab:34:ca:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ee1e19b755a24f497e45be308608413ab34ca90/; sid:903200242; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"cc:90:86:37:d1:3e:34:a8:b9:74:25:23:41:39:68:d9:17:23:50:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cc908637d13e34a8b9742523413968d9172350bd/; sid:903200243; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d1:d7:c6:99:b9:f2:90:13:33:62:69:63:4f:99:b5:af:91:dc:3f:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1d7c699b9f29013336269634f99b5af91dc3fa1/; sid:903200244; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"72:1f:63:51:c5:47:80:af:14:72:42:47:fe:44:20:83:81:78:24:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/721f6351c54780af14724247fe44208381782446/; sid:903200245; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4b:c8:d6:62:48:dd:64:b6:f3:55:58:c3:32:97:a4:76:02:d8:5a:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4bc8d66248dd64b6f35558c33297a47602d85a9c/; sid:903200246; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"dd:0b:68:1f:32:6e:e4:71:72:56:9a:5d:68:ce:0c:a7:86:c3:c3:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd0b681f326ee47172569a5d68ce0ca786c3c366/; sid:903200247; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"75:67:0e:16:b0:57:4f:3e:61:8b:73:76:66:28:db:d3:b7:a0:80:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75670e16b0574f3e618b73766628dbd3b7a0806a/; sid:903200248; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"37:a3:a1:4b:4e:cb:ac:5e:32:14:7c:0d:dd:a5:e9:d6:bd:db:b4:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37a3a14b4ecbac5e32147c0ddda5e9d6bddbb4b9/; sid:903200249; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"46:c0:ba:68:47:eb:c7:66:cc:16:ff:c1:d9:5d:9d:fc:df:8e:f3:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46c0ba6847ebc766cc16ffc1d95d9dfcdf8ef33a/; sid:903200250; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"83:4f:8f:2f:5c:d9:74:95:43:22:7d:7f:ed:e9:ee:9e:5e:07:c9:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/834f8f2f5cd9749543227d7fede9ee9e5e07c9e8/; sid:903200251; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fe:19:de:10:89:80:39:3a:b9:1f:28:24:ce:96:b8:ca:b0:f8:41:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe19de108980393ab91f2824ce96b8cab0f84163/; sid:903200252; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"82:3c:a6:c8:68:b1:c6:b7:dc:99:5c:d2:42:4d:b8:a7:a7:6f:3c:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/823ca6c868b1c6b7dc995cd2424db8a7a76f3c2c/; sid:903200253; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"43:ba:13:8a:61:b9:7d:f7:78:e2:92:16:25:2e:ec:ef:9a:5c:2b:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43ba138a61b97df778e29216252eecef9a5c2b2b/; sid:903200254; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f8:9b:fc:5c:43:a2:d8:2b:62:9f:ff:36:02:37:88:65:df:67:0f:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f89bfc5c43a2d82b629fff3602378865df670f4e/; sid:903200255; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"85:09:b1:f8:00:60:9c:ce:ee:7f:13:61:79:ca:0f:53:2b:8e:1a:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8509b1f800609cceee7f136179ca0f532b8e1a19/; sid:903200256; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"72:bd:d3:b7:5f:4a:bb:8d:9d:a0:ac:9f:ca:98:af:77:2f:c7:70:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72bdd3b75f4abb8d9da0ac9fca98af772fc7703d/; sid:903200257; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"29:29:3a:3f:0d:fd:2f:1f:f2:9c:5d:6a:d0:f6:89:1b:a0:c3:bf:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/29293a3f0dfd2f1ff29c5d6ad0f6891ba0c3bf58/; sid:903200258; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"2c:4e:b1:f1:5a:4a:41:00:20:67:26:b5:c8:f9:e2:b8:d3:72:ac:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c4eb1f15a4a4100206726b5c8f9e2b8d372ac06/; sid:903200259; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"06:d5:05:4b:ee:1b:52:df:c4:32:99:48:89:33:3d:a3:ba:74:bd:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06d5054bee1b52dfc432994889333da3ba74bd78/; sid:903200260; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"bc:74:0f:b3:5c:31:87:2e:de:78:dd:85:19:2d:e4:d1:9b:93:01:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc740fb35c31872ede78dd85192de4d19b9301c8/; sid:903200261; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"da:ab:66:9c:bd:eb:35:41:9e:76:e9:fb:4a:14:38:88:0a:67:46:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/daab669cbdeb35419e76e9fb4a1438880a67467b/; sid:903200262; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e1:bf:9e:9f:22:cd:fb:1f:05:f6:f3:ee:c8:10:0f:15:9b:07:50:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1bf9e9f22cdfb1f05f6f3eec8100f159b07503c/; sid:903200263; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"db:44:ff:75:33:4b:43:4a:e5:40:ca:41:25:df:ec:29:9e:85:8d:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db44ff75334b434ae540ca4125dfec299e858db7/; sid:903200264; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d1:9f:90:1f:4f:9f:f3:a0:99:39:a3:79:bd:77:0d:dc:97:f2:1d:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d19f901f4f9ff3a09939a379bd770ddc97f21ddd/; sid:903200265; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5f:69:c6:98:b2:37:7d:63:49:4c:3d:b9:f9:c4:a2:61:96:4d:c4:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f69c698b2377d63494c3db9f9c4a261964dc4a1/; sid:903200266; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c9:26:7f:47:e4:43:b1:30:d6:ac:e1:6c:fc:61:e7:5b:11:02:ea:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9267f47e443b130d6ace16cfc61e75b1102eaeb/; sid:903200267; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"43:b9:85:8b:94:57:cc:10:a0:21:a4:fb:da:d1:d2:90:f7:8a:02:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43b9858b9457cc10a021a4fbdad1d290f78a0213/; sid:903200268; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e0:f2:b5:0a:25:10:a1:d6:75:e8:bb:48:99:4b:18:dc:2a:08:57:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e0f2b50a2510a1d675e8bb48994b18dc2a08578b/; sid:903200269; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"62:0a:06:25:e7:9e:3a:ee:c7:b7:7a:bf:4e:d6:34:59:94:c3:c1:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/620a0625e79e3aeec7b77abf4ed6345994c3c14b/; sid:903200270; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"13:b6:56:37:1e:83:02:2e:26:ac:7c:82:e3:91:bb:2b:34:de:53:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/13b656371e83022e26ac7c82e391bb2b34de53bf/; sid:903200271; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6a:ad:4d:9b:0e:a4:a2:ff:8b:25:03:7a:5b:17:0d:54:ff:f7:5e:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6aad4d9b0ea4a2ff8b25037a5b170d54fff75e7f/; sid:903200272; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e3:22:77:ba:58:42:21:85:86:ee:c7:bc:72:56:05:f3:f3:fa:6f:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e32277ba5842218586eec7bc725605f3f3fa6f2b/; sid:903200273; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b0:2b:3d:3d:90:a0:e0:2b:10:87:07:08:1e:1b:1b:4f:67:34:c0:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b02b3d3d90a0e02b108707081e1b1b4f6734c0d0/; sid:903200274; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e5:54:ae:e3:e2:bc:fc:33:46:a6:b0:46:7d:16:76:63:aa:c9:f6:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e554aee3e2bcfc3346a6b0467d167663aac9f6e0/; sid:903200275; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (URLzone C&C)"; tls_cert_fingerprint; content:"41:5a:58:6a:12:11:58:60:23:92:d5:63:94:a5:90:3d:fe:22:2a:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/415a586a121158602392d56394a5903dfe222a0c/; sid:903200276; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"9f:61:eb:e4:e9:af:3a:a9:fd:34:f8:f3:ee:82:a3:ff:b3:0d:0f:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9f61ebe4e9af3aa9fd34f8f3ee82a3ffb30d0f5a/; sid:903200277; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"62:04:98:2e:47:f5:db:cc:b4:45:3a:6e:5d:3f:79:96:f0:58:6d:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6204982e47f5dbccb4453a6e5d3f7996f0586de3/; sid:903200278; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"17:2d:e1:d1:15:c4:12:69:61:ea:d6:10:9f:8b:4f:85:33:70:d5:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/172de1d115c4126961ead6109f8b4f853370d54c/; sid:903200279; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"97:63:d9:62:a9:c6:ba:ab:bc:5c:c9:45:ef:11:d2:15:20:6f:f3:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9763d962a9c6baabbc5cc945ef11d215206ff3ba/; sid:903200280; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"30:44:73:9c:06:ea:1d:c1:b3:ce:54:b7:f6:e0:0e:c2:5d:6e:36:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3044739c06ea1dc1b3ce54b7f6e00ec25d6e36da/; sid:903200281; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"25:12:1a:7e:32:e2:9e:a2:ea:4e:29:3a:45:f1:c3:aa:4e:d8:2c:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25121a7e32e29ea2ea4e293a45f1c3aa4ed82cfa/; sid:903200282; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"37:22:b4:e0:63:82:08:03:19:e0:a3:26:a5:45:ad:af:43:56:50:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3722b4e06382080319e0a326a545adaf43565022/; sid:903200283; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8c:d7:59:5c:e7:e7:9c:1d:7d:88:31:eb:e8:7f:1a:42:14:17:b1:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8cd7595ce7e79c1d7d8831ebe87f1a421417b113/; sid:903200284; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1d:5e:2f:62:83:f4:7a:5e:27:94:b5:48:41:bd:45:12:5d:e8:9e:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d5e2f6283f47a5e2794b54841bd45125de89e77/; sid:903200285; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"83:c3:f8:6d:50:79:e5:cb:5a:8e:f6:b9:c4:ad:a5:45:69:32:4e:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/83c3f86d5079e5cb5a8ef6b9c4ada54569324ee4/; sid:903200286; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6a:7e:d6:58:ec:d0:4e:8d:38:ed:8b:31:4e:3f:a4:c7:b2:67:00:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a7ed658ecd04e8d38ed8b314e3fa4c7b26700c7/; sid:903200287; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"81:a9:2c:f2:47:9e:7d:54:7a:ef:7c:ef:42:aa:d4:68:b9:75:52:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/81a92cf2479e7d547aef7cef42aad468b9755224/; sid:903200288; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"fc:e3:37:e0:e5:71:d9:38:4c:71:41:e9:39:0c:36:72:d9:3e:3a:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fce337e0e571d9384c7141e9390c3672d93e3a4b/; sid:903200289; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"29:69:9b:84:9f:96:3c:b7:fe:bd:e1:59:08:7e:b1:d7:18:41:ae:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/29699b849f963cb7febde159087eb1d71841aef0/; sid:903200290; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e4:62:ab:3c:9d:f3:b7:b7:3e:15:65:22:93:5b:72:d7:02:8b:6a:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e462ab3c9df3b7b73e156522935b72d7028b6a11/; sid:903200291; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6a:9f:7c:59:90:fb:4d:30:82:65:8b:0e:92:19:47:86:f4:e7:5d:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a9f7c5990fb4d3082658b0e92194786f4e75d4f/; sid:903200292; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b7:02:07:35:3e:59:15:ff:28:75:cd:d7:ad:d9:d4:60:90:e5:8b:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b70207353e5915ff2875cdd7add9d46090e58bd5/; sid:903200293; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CryptoLocker C&C)"; tls_cert_fingerprint; content:"09:19:6f:48:ad:7c:4d:14:f4:3e:87:d7:8f:7f:10:40:f5:17:8c:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09196f48ad7c4d14f43e87d78f7f1040f5178c9f/; sid:903200294; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"98:d9:e6:2e:6d:2b:66:cd:30:08:d4:c9:3d:c9:a1:b6:5e:18:c7:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/98d9e62e6d2b66cd3008d4c93dc9a1b65e18c7c6/; sid:903200295; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c8:55:7c:64:19:a8:69:ab:7a:b2:7e:50:a0:93:54:dd:a8:87:f4:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8557c6419a869ab7ab27e50a09354dda887f4d6/; sid:903200296; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f8:96:ce:86:54:34:a5:cf:b5:97:8f:05:4f:2a:a9:49:d0:5a:ec:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f896ce865434a5cfb5978f054f2aa949d05aece2/; sid:903200297; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c2:1a:07:55:87:8a:55:f9:40:7a:36:4d:21:01:4f:e8:99:f2:17:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c21a0755878a55f9407a364d21014fe899f21770/; sid:903200298; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8f:2c:03:95:6c:26:39:5b:0d:d2:16:d1:66:7c:84:0e:a3:ac:de:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f2c03956c26395b0dd216d1667c840ea3acde55/; sid:903200299; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"e5:7a:82:a8:a3:81:58:19:43:39:c4:43:61:be:38:5d:3a:fc:74:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e57a82a8a38158194339c44361be385d3afc74d4/; sid:903200300; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"df:ce:aa:12:4f:dc:c0:51:15:d3:58:9c:6e:2f:49:36:20:df:59:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfceaa124fdcc05115d3589c6e2f493620df59b9/; sid:903200301; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7a:3f:9f:31:4e:4d:99:e0:41:ff:c8:0c:8e:d8:b1:b4:2f:ff:32:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a3f9f314e4d99e041ffc80c8ed8b1b42fff321b/; sid:903200302; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5b:03:d8:de:93:10:ac:1b:2b:6f:ed:92:07:49:44:36:fb:82:c2:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b03d8de9310ac1b2b6fed9207494436fb82c21c/; sid:903200303; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"65:6b:00:be:7f:39:b4:37:3c:f8:f5:36:32:44:da:84:2d:d4:3f:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/656b00be7f39b4373cf8f5363244da842dd43fb0/; sid:903200304; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8f:e0:35:28:d4:6a:fd:e9:e6:e3:e9:52:1c:6e:9d:be:8d:aa:92:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8fe03528d46afde9e6e3e9521c6e9dbe8daa92bc/; sid:903200305; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"33:f9:91:63:63:58:30:25:79:fd:fb:11:c0:74:ee:00:4c:8f:2a:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33f991636358302579fdfb11c074ee004c8f2a43/; sid:903200306; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"d8:af:2f:6a:1a:2b:a2:b1:b6:e1:a2:60:e7:91:fc:ab:88:cc:2c:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8af2f6a1a2ba2b1b6e1a260e791fcab88cc2c8d/; sid:903200307; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d4:73:ab:95:f7:4d:75:90:d5:aa:0d:ed:fc:f7:de:64:90:37:1a:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d473ab95f74d7590d5aa0dedfcf7de6490371abc/; sid:903200308; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d2:c5:42:57:60:24:a7:46:d4:71:3d:a9:cb:26:38:06:ff:62:f8:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2c542576024a746d4713da9cb263806ff62f8bd/; sid:903200309; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"80:38:3b:3a:06:ed:08:15:96:9c:53:56:fb:34:31:94:5f:ac:19:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80383b3a06ed0815969c5356fb3431945fac19b2/; sid:903200310; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d5:27:9c:60:9f:96:ab:1e:28:69:83:1a:f5:5f:69:5b:88:e1:15:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d5279c609f96ab1e2869831af55f695b88e11552/; sid:903200311; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"33:22:7d:25:c8:34:db:b0:73:c5:8c:96:21:6d:0a:6a:6f:8a:e1:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33227d25c834dbb073c58c96216d0a6a6f8ae183/; sid:903200312; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"da:a3:1b:ce:58:4f:16:42:50:0b:7a:e2:eb:6f:ed:5b:04:0a:95:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/daa31bce584f1642500b7ae2eb6fed5b040a95c6/; sid:903200313; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"34:2d:42:8b:8c:06:1d:e3:5c:3f:5c:5c:ed:44:12:4d:7f:20:fd:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/342d428b8c061de35c3f5c5ced44124d7f20fdc0/; sid:903200314; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f1:01:c9:85:f5:3d:55:e5:90:37:e3:2a:90:ca:13:d3:a8:85:53:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f101c985f53d55e59037e32a90ca13d3a8855318/; sid:903200315; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"d6:2e:06:53:11:df:fc:ec:ad:9f:8e:92:c3:16:aa:fb:60:19:39:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d62e065311dffcecad9f8e92c316aafb6019394b/; sid:903200316; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"8f:9a:5e:3a:7a:21:5a:18:50:14:77:0d:7d:5d:6b:53:7f:49:a1:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f9a5e3a7a215a185014770d7d5d6b537f49a172/; sid:903200317; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"96:6c:7b:a7:62:e3:57:d2:47:88:81:76:fd:1d:33:6b:8e:fb:e5:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/966c7ba762e357d247888176fd1d336b8efbe544/; sid:903200318; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Upatre C&C)"; tls_cert_fingerprint; content:"db:2c:df:31:71:d9:2d:90:f1:1f:ec:d2:11:63:59:9f:3c:5f:b7:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db2cdf3171d92d90f11fecd21163599f3c5fb7c4/; sid:903200319; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"52:aa:c1:54:07:15:82:b3:2f:b4:e9:f2:ca:19:37:fa:a2:de:d4:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52aac154071582b32fb4e9f2ca1937faa2ded4fb/; sid:903200320; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a8:d1:eb:83:6f:40:b6:c9:f4:26:10:29:7e:99:e3:b6:8d:10:66:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a8d1eb836f40b6c9f42610297e99e3b68d1066a3/; sid:903200321; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"d5:70:21:bf:03:61:6b:89:cd:24:09:b2:3b:36:c6:a4:af:a2:6b:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d57021bf03616b89cd2409b23b36c6a4afa26bd4/; sid:903200322; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a6:20:37:da:82:ab:89:61:2d:df:bb:31:50:bb:08:e6:bb:58:a3:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a62037da82ab89612ddfbb3150bb08e6bb58a332/; sid:903200323; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"94:81:e6:10:f0:51:8e:48:9c:33:ef:0b:fa:08:b5:65:91:ba:dd:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9481e610f0518e489c33ef0bfa08b56591baddef/; sid:903200324; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"82:c7:fe:a2:a9:3a:d0:be:ab:78:41:dc:4a:28:3e:65:ee:90:57:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/82c7fea2a93ad0beab7841dc4a283e65ee905736/; sid:903200325; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"60:45:18:1f:02:47:74:9d:a4:40:7d:d2:7c:4e:01:2f:b6:ab:4a:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6045181f0247749da4407dd27c4e012fb6ab4a9c/; sid:903200326; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"c7:1a:e2:3d:0c:02:23:a2:b2:22:8b:fe:8c:9e:0b:c7:51:57:08:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c71ae23d0c0223a2b2228bfe8c9e0bc75157086a/; sid:903200327; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"b4:6e:5c:69:c4:e7:ef:f1:71:8e:0a:9c:b2:18:94:d6:e0:7b:e1:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b46e5c69c4e7eff1718e0a9cb21894d6e07be10e/; sid:903200328; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"0d:34:e3:ba:96:35:25:7c:93:56:fb:1d:d9:be:64:b0:c7:a0:8e:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0d34e3ba9635257c9356fb1dd9be64b0c7a08ef3/; sid:903200329; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a0:c4:d5:41:d7:55:53:fe:96:51:2f:22:99:98:96:b0:ed:fc:73:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a0c4d541d75553fe96512f22999896b0edfc735b/; sid:903200330; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"0d:8e:5b:2c:b2:2c:0c:3b:1b:b4:cc:9e:ef:3f:a7:47:88:35:11:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0d8e5b2cb22c0c3b1bb4cc9eef3fa74788351165/; sid:903200331; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"bb:2c:ab:20:d4:7b:84:ff:96:43:2f:51:6d:72:eb:ba:5a:a0:90:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb2cab20d47b84ff96432f516d72ebba5aa09067/; sid:903200332; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"9e:1d:7b:d8:6f:bc:e6:09:d0:18:3c:28:27:e4:8b:4c:56:10:7e:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e1d7bd86fbce609d0183c2827e48b4c56107eeb/; sid:903200333; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Bebloh C&C)"; tls_cert_fingerprint; content:"a7:0c:1c:d9:a9:01:28:e6:d5:9a:a0:4b:80:d3:1d:79:01:38:1f:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a70c1cd9a90128e6d59aa04b80d31d7901381f9e/; sid:903200334; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"91:6c:55:cb:a3:aa:72:bd:00:00:85:e9:52:f8:e7:f5:fa:f4:38:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/916c55cba3aa72bd000085e952f8e7f5faf438b3/; sid:903200335; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"74:72:24:74:09:3f:09:9b:0d:e7:30:77:c5:f2:2d:25:76:07:7c:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/74722474093f099b0de73077c5f22d2576077c3d/; sid:903200336; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"07:7c:73:8a:10:d0:ad:2f:7a:74:9a:d4:c9:49:21:bc:b2:97:3e:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/077c738a10d0ad2f7a749ad4c94921bcb2973ed0/; sid:903200337; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"4f:32:17:0b:76:e7:a3:93:a6:93:06:bc:dd:e0:27:d2:9c:89:24:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4f32170b76e7a393a69306bcdde027d29c8924ec/; sid:903200338; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:25:21:2f:60:da:80:90:77:1b:27:40:3c:7f:49:e7:0b:ab:53:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4325212f60da8090771b27403c7f49e70bab53aa/; sid:903200339; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d7:91:8e:e6:ee:f0:1a:3c:71:36:de:17:5b:4f:62:eb:45:3b:09:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7918ee6eef01a3c7136de175b4f62eb453b09ed/; sid:903200340; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6b:59:04:8f:16:e2:a5:0b:a6:e4:60:1b:42:ba:99:a3:19:5d:2d:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b59048f16e2a50ba6e4601b42ba99a3195d2d1f/; sid:903200341; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"07:17:35:e3:46:e3:68:67:f6:bc:89:75:25:d6:db:13:98:c8:65:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/071735e346e36867f6bc897525d6db1398c865b7/; sid:903200342; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"75:d1:03:11:e4:0d:bf:0f:a7:fe:4d:de:14:b5:af:8b:3c:ac:77:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75d10311e40dbf0fa7fe4dde14b5af8b3cac77ee/; sid:903200343; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7e:fa:f5:f1:db:b6:33:97:57:f5:21:53:93:a5:f1:73:13:48:cd:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7efaf5f1dbb6339757f5215393a5f1731348cdee/; sid:903200344; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c5:31:06:8c:e6:27:5a:a3:11:47:5b:f9:ba:54:89:7f:03:db:34:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c531068ce6275aa311475bf9ba54897f03db3498/; sid:903200345; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f0:db:8b:dc:4a:5f:12:5b:ea:ca:d8:a3:c6:f2:0e:7f:01:81:54:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0db8bdc4a5f125beacad8a3c6f20e7f018154ba/; sid:903200346; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:b7:cd:8a:35:a3:36:d6:5b:db:9b:84:c9:cb:d8:56:ee:84:f7:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ab7cd8a35a336d65bdb9b84c9cbd856ee84f7b0/; sid:903200347; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b8:1e:db:ff:b8:89:f6:ca:c8:84:32:fa:15:cb:86:99:eb:3f:42:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b81edbffb889f6cac88432fa15cb8699eb3f42aa/; sid:903200348; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"63:c2:1a:c1:aa:d8:dd:be:82:2e:e5:8b:62:56:90:27:19:0e:e3:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63c21ac1aad8ddbe822ee58b62569027190ee3a2/; sid:903200349; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"79:24:18:c2:97:20:33:44:55:9c:6a:74:a1:17:5d:33:67:ff:48:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/792418c297203344559c6a74a1175d3367ff4810/; sid:903200350; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"33:af:e6:2d:c5:0b:6d:53:05:4b:7d:b3:e8:20:5c:48:ab:53:88:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33afe62dc50b6d53054b7db3e8205c48ab538895/; sid:903200351; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b7:8f:69:a4:96:58:dc:63:40:5c:19:82:9f:8d:1c:20:f9:80:11:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b78f69a49658dc63405c19829f8d1c20f98011da/; sid:903200352; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5b:1b:69:fc:d2:38:17:df:99:45:05:9b:2e:5d:6f:8a:6a:77:14:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b1b69fcd23817df9945059b2e5d6f8a6a7714d7/; sid:903200353; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d8:0a:79:c1:3a:7d:6a:86:9e:e6:59:d9:7c:17:24:53:89:ba:d3:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d80a79c13a7d6a869ee659d97c17245389bad338/; sid:903200354; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9e:07:64:b6:a3:8c:a0:0b:41:3e:41:57:40:b9:26:87:26:3b:6e:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e0764b6a38ca00b413e415740b92687263b6e23/; sid:903200355; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"54:08:d2:2b:17:86:24:67:23:bd:60:fe:82:fc:f9:30:b4:2b:10:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5408d22b1786246723bd60fe82fcf930b42b10e3/; sid:903200356; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:46:0a:72:f8:86:11:c1:fc:d7:f4:d6:93:8c:da:80:c9:4f:9c:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c7460a72f88611c1fcd7f4d6938cda80c94f9c71/; sid:903200357; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b9:ea:1c:3b:6b:0e:35:7c:a8:e0:7c:21:47:5d:a3:47:bd:58:31:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b9ea1c3b6b0e357ca8e07c21475da347bd5831e1/; sid:903200358; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7b:f1:fd:8b:0d:dd:ed:dc:ba:4b:88:1b:d8:b8:d4:e0:fe:42:f3:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7bf1fd8b0dddeddcba4b881bd8b8d4e0fe42f39c/; sid:903200359; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"68:17:d3:c8:67:09:96:5f:05:7c:46:54:e9:46:66:ea:bd:28:71:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6817d3c86709965f057c4654e94666eabd2871e4/; sid:903200360; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:71:f8:eb:8b:bd:fe:04:05:32:33:27:73:2f:fe:d2:f9:49:23:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0671f8eb8bbdfe0405323327732ffed2f949239a/; sid:903200361; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"d5:f0:34:95:3c:a1:c9:e5:0a:6c:0c:45:47:3a:e0:21:d6:fe:7e:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d5f034953ca1c9e50a6c0c45473ae021d6fe7e93/; sid:903200362; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c6:31:7f:34:1b:09:08:01:e0:2d:81:53:c9:0b:ab:22:c6:6d:a9:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6317f341b090801e02d8153c90bab22c66da9fc/; sid:903200363; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ae:67:49:0c:a3:4a:6d:49:48:39:8d:85:c1:a6:b0:30:90:9a:e3:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae67490ca34a6d4948398d85c1a6b030909ae336/; sid:903200364; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fe:6c:4a:e2:f3:4e:b1:90:2c:b9:b5:00:63:9b:e4:b2:a1:92:35:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe6c4ae2f34eb1902cb9b500639be4b2a1923540/; sid:903200365; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:1b:a6:d9:25:df:f8:4b:63:55:7c:2c:7d:32:d9:ff:5f:a9:30:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d1ba6d925dff84b63557c2c7d32d9ff5fa930c9/; sid:903200366; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4a:e4:bf:b1:37:f1:76:a9:ef:e0:7c:07:34:9d:d9:c1:8a:c3:0b:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ae4bfb137f176a9efe07c07349dd9c18ac30bf1/; sid:903200367; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7d:2b:10:41:35:40:ac:41:fe:fa:93:30:12:9f:56:c8:cc:51:c9:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d2b10413540ac41fefa9330129f56c8cc51c9ac/; sid:903200368; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"40:a5:58:b1:d4:36:ee:b6:be:5f:6a:93:82:84:f4:68:cc:30:a7:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/40a558b1d436eeb6be5f6a938284f468cc30a725/; sid:903200369; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:48:6e:1b:49:90:a1:e0:f5:4c:29:b5:d6:1e:32:b7:2a:4b:94:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52486e1b4990a1e0f54c29b5d61e32b72a4b94d7/; sid:903200370; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:fe:08:46:06:cd:64:5e:20:03:91:ac:52:51:4c:53:05:14:51:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6fe084606cd645e200391ac52514c5305145121/; sid:903200371; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"29:78:e9:7b:cc:2d:50:7d:04:d6:4d:f9:31:55:fc:f3:78:a2:29:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2978e97bcc2d507d04d64df93155fcf378a2295d/; sid:903200372; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Teslacrypt C&C)"; tls_cert_fingerprint; content:"a0:af:f4:d8:92:57:8e:75:4b:e0:39:98:62:41:ee:42:4f:dd:56:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a0aff4d892578e754be039986241ee424fdd561f/; sid:903200373; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"7b:62:ef:2b:59:9c:70:02:be:f6:c9:a6:c0:c8:33:a5:5e:65:fc:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b62ef2b599c7002bef6c9a6c0c833a55e65fcfc/; sid:903200374; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5f:98:7a:b1:75:7e:82:af:e2:0f:24:ec:27:18:ff:1e:29:44:67:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f987ab1757e82afe20f24ec2718ff1e294467c5/; sid:903200375; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5f:15:b5:0e:24:f1:4e:09:7d:f4:5b:fc:67:d6:c4:4b:a1:31:d6:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f15b50e24f14e097df45bfc67d6c44ba131d673/; sid:903200376; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:2c:8b:5a:06:28:52:b5:ea:20:5e:f0:48:22:b5:fc:a9:96:97:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/312c8b5a062852b5ea205ef04822b5fca99697da/; sid:903200377; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:84:c7:22:43:01:42:d8:1a:77:1d:0b:ad:6a:0b:33:b9:4b:e9:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a484c722430142d81a771d0bad6a0b33b94be95f/; sid:903200378; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c0:b0:6e:ce:e5:d1:ac:b1:a7:f7:b0:7f:9e:a7:50:3c:9e:a5:f4:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0b06ecee5d1acb1a7f7b07f9ea7503c9ea5f4af/; sid:903200379; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"30:27:2e:19:92:4b:32:af:5d:e2:3c:b2:95:ec:e5:86:11:78:dd:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30272e19924b32af5de23cb295ece5861178dd2e/; sid:903200380; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"86:b7:5b:29:79:87:0b:b5:71:ec:b9:57:34:9f:5e:3c:e1:c9:c2:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86b75b2979870bb571ecb957349f5e3ce1c9c26b/; sid:903200381; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"76:0b:b4:76:5c:67:1e:0c:05:7b:77:8d:67:f5:b5:ea:94:70:84:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/760bb4765c671e0c057b778d67f5b5ea947084f9/; sid:903200382; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"13:97:72:97:7c:43:96:a9:47:40:49:3c:6a:8e:fc:33:9a:35:16:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/139772977c4396a94740493c6a8efc339a3516c6/; sid:903200383; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2b:44:7b:89:61:17:f2:8c:ba:93:6b:56:02:17:0c:78:cf:9c:3b:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b447b896117f28cba936b5602170c78cf9c3b77/; sid:903200384; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"6d:8d:d8:af:a5:8b:69:8a:00:d6:3e:51:bd:01:ce:14:6b:0c:c6:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d8dd8afa58b698a00d63e51bd01ce146b0cc67b/; sid:903200385; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e3:0c:67:8e:4f:ed:a1:78:83:f8:7f:9f:68:72:6f:6d:3b:30:f1:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e30c678e4feda17883f87f9f68726f6d3b30f151/; sid:903200386; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ce:27:0b:de:79:7d:93:85:96:ef:d7:4f:98:34:61:f6:2b:f0:40:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce270bde797d938596efd74f983461f62bf04069/; sid:903200387; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ee:b1:80:10:fb:1a:82:61:ed:1a:a5:1a:20:2c:59:a5:77:50:45:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eeb18010fb1a8261ed1aa51a202c59a577504583/; sid:903200388; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:f1:79:90:b7:74:1a:84:f0:1a:90:5d:bd:b2:10:32:c1:de:ed:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32f17990b7741a84f01a905dbdb21032c1deeded/; sid:903200389; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"89:b0:ee:08:a5:8d:1d:3b:96:2e:9f:f9:62:d1:16:ce:cd:da:fe:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89b0ee08a58d1d3b962e9ff962d116cecddafe06/; sid:903200390; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:72:ac:43:cf:28:e6:69:16:27:5b:c2:1b:d8:74:b5:0e:e7:91:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a672ac43cf28e66916275bc21bd874b50ee791f2/; sid:903200391; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b0:93:aa:01:28:57:b3:dd:4d:5b:b3:0d:2d:98:b7:c9:77:47:47:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b093aa012857b3dd4d5bb30d2d98b7c9774747ab/; sid:903200392; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"49:5d:aa:71:be:4c:93:36:12:72:eb:bb:ce:f6:00:9a:46:fd:de:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/495daa71be4c93361272ebbbcef6009a46fddeaa/; sid:903200393; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cb:03:d4:5f:c2:36:6a:1c:c4:b5:66:e3:e0:bb:29:08:40:b9:46:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb03d45fc2366a1cc4b566e3e0bb290840b946f8/; sid:903200394; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:97:52:cb:14:be:2d:f6:f2:84:ec:7b:25:15:84:a2:35:34:fd:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a49752cb14be2df6f284ec7b251584a23534fd69/; sid:903200395; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"24:c3:bb:e5:42:a9:21:06:a0:e7:31:23:17:11:c3:87:1a:07:c6:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24c3bbe542a92106a0e731231711c3871a07c6a6/; sid:903200396; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cc:76:f1:95:7e:9e:aa:f2:01:d6:f1:53:c9:f5:a8:62:b1:7b:92:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cc76f1957e9eaaf201d6f153c9f5a862b17b9216/; sid:903200397; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0b:0d:83:8a:e8:86:41:2b:31:a3:f6:f0:e9:75:6d:4c:27:5d:be:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b0d838ae886412b31a3f6f0e9756d4c275dbe6c/; sid:903200398; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"94:4a:f8:c1:83:6e:b6:71:78:bf:64:f7:79:5b:52:8e:91:3b:e7:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/944af8c1836eb67178bf64f7795b528e913be790/; sid:903200399; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"80:dc:ab:9a:1b:68:7f:8f:71:8b:70:07:1c:21:47:7b:62:59:cb:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80dcab9a1b687f8f718b70071c21477b6259cb38/; sid:903200400; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a7:e0:7b:ca:12:8b:36:b9:f1:e4:3d:5b:fa:5b:28:eb:74:21:da:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a7e07bca128b36b9f1e43d5bfa5b28eb7421dab7/; sid:903200401; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"95:0c:b0:cf:d0:a0:86:9a:db:19:fa:00:9d:b7:4b:83:ea:6d:a4:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/950cb0cfd0a0869adb19fa009db74b83ea6da4dd/; sid:903200402; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:74:e1:e3:a4:1a:aa:41:1c:b7:53:16:f6:84:59:14:0e:a3:47:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8574e1e3a41aaa411cb75316f68459140ea34798/; sid:903200403; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"11:bd:be:13:ce:a3:5d:51:61:4d:f7:cb:ab:70:cc:0a:5b:ce:b3:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11bdbe13cea35d51614df7cbab70cc0a5bceb343/; sid:903200404; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:0e:54:4e:3c:27:8a:10:b7:17:f0:d7:91:01:62:1b:a1:99:af:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/770e544e3c278a10b717f0d79101621ba199af27/; sid:903200405; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"96:f2:44:cc:92:9e:2d:15:20:2b:c3:4c:df:c2:59:e0:76:e6:08:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/96f244cc929e2d15202bc34cdfc259e076e60807/; sid:903200406; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ac:b9:6e:00:e0:d8:11:74:2d:72:81:bb:61:61:98:cc:80:3c:37:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acb96e00e0d811742d7281bb616198cc803c371b/; sid:903200407; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e3:28:f4:62:dc:20:a7:fa:2c:72:25:ea:8d:08:c4:e5:28:09:9c:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e328f462dc20a7fa2c7225ea8d08c4e528099c34/; sid:903200408; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:1e:11:14:f1:78:3a:4a:9a:66:84:31:b0:d6:ac:ea:ca:69:d4:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/311e1114f1783a4a9a668431b0d6aceaca69d4db/; sid:903200409; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:16:9e:67:47:3f:6f:ee:d0:c1:fc:48:21:07:e0:83:12:5d:2d:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c7169e67473f6feed0c1fc482107e083125d2dad/; sid:903200410; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8d:ab:f9:1f:5c:68:62:35:87:1c:b2:63:aa:4d:70:ac:27:be:53:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8dabf91f5c686235871cb263aa4d70ac27be5316/; sid:903200411; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:4f:e8:34:a2:e4:cd:b4:3c:f5:c9:2e:a4:8d:4d:84:48:7e:ea:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c14fe834a2e4cdb43cf5c92ea48d4d84487eea5b/; sid:903200412; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2a:1b:79:49:57:61:dc:5b:b0:cc:20:10:06:0c:5b:d7:a4:7f:11:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a1b79495761dc5bb0cc2010060c5bd7a47f1129/; sid:903200413; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5e:fd:89:f9:dd:a9:bb:ec:ec:26:6c:f0:a5:c5:dd:65:8f:c8:4b:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5efd89f9dda9bbecec266cf0a5c5dd658fc84b03/; sid:903200414; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:9d:05:bc:51:e2:53:d6:d2:86:75:63:0d:1e:ac:2f:1e:1f:f4:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/859d05bc51e253d6d28675630d1eac2f1e1ff4ae/; sid:903200415; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ac:5c:1f:1a:a5:75:3d:f8:2a:1d:58:7d:3c:d8:41:50:69:61:3b:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac5c1f1aa5753df82a1d587d3cd8415069613b61/; sid:903200416; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e8:0d:4f:88:e3:02:96:41:a4:4b:02:3a:5f:da:1f:95:d5:0d:5e:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e80d4f88e3029641a44b023a5fda1f95d50d5e40/; sid:903200417; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"17:ff:78:8a:e0:4c:e1:0d:27:8a:40:d0:e1:e8:cc:ab:1d:0d:c8:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17ff788ae04ce10d278a40d0e1e8ccab1d0dc8f8/; sid:903200418; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"66:c8:25:a3:64:01:15:b3:00:ea:ac:b7:8b:6d:09:8f:d1:43:92:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66c825a3640115b300eaacb78b6d098fd14392a6/; sid:903200419; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:23:5d:bb:db:7a:42:ad:7c:01:9a:53:2e:41:3d:69:f4:10:a5:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a4235dbbdb7a42ad7c019a532e413d69f410a512/; sid:903200420; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:50:df:98:2f:35:fa:42:85:de:8c:7e:c8:31:e1:13:34:e8:70:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7750df982f35fa4285de8c7ec831e11334e87067/; sid:903200421; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8d:9d:aa:2c:bc:90:6d:69:2f:8f:5d:40:e2:9c:4d:ec:b2:63:b9:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d9daa2cbc906d692f8f5d40e29c4decb263b979/; sid:903200422; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"53:36:38:1a:24:6b:84:8e:4d:ab:1f:24:8f:c7:5c:d4:b5:ce:71:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5336381a246b848e4dab1f248fc75cd4b5ce71f3/; sid:903200423; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"db:cc:6a:0b:a2:f3:6e:c9:0e:83:ae:df:59:d5:1d:49:52:53:30:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbcc6a0ba2f36ec90e83aedf59d51d4952533021/; sid:903200424; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"65:05:8a:2a:00:3f:61:57:2c:da:96:11:79:7f:59:6a:20:39:e1:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/65058a2a003f61572cda9611797f596a2039e104/; sid:903200425; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dd:ab:8f:63:91:e8:55:c7:51:ee:82:56:62:bd:83:c9:cf:2d:9b:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddab8f6391e855c751ee825662bd83c9cf2d9bc3/; sid:903200426; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"62:58:62:1f:ec:54:d5:04:f5:1a:16:67:85:da:5a:53:69:c0:ad:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6258621fec54d504f51a166785da5a5369c0ad72/; sid:903200427; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"70:bf:60:e1:72:c4:3d:07:65:71:cf:af:bb:a3:a6:ba:69:a2:50:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/70bf60e172c43d076571cfafbba3a6ba69a25084/; sid:903200428; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:6d:4a:34:93:83:50:62:51:ff:d9:00:21:46:d2:a3:82:17:ba:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c76d4a349383506251ffd9002146d2a38217bacd/; sid:903200429; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d1:a2:e7:ae:91:82:1e:3e:ba:c4:61:a0:8d:c0:dd:cf:6b:3c:a5:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1a2e7ae91821e3ebac461a08dc0ddcf6b3ca5ae/; sid:903200430; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:66:cb:87:70:90:cf:88:42:0b:34:14:a3:bf:01:b4:fa:50:fb:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d66cb877090cf88420b3414a3bf01b4fa50fb47/; sid:903200431; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:07:22:8a:2e:bf:2c:43:b4:41:5f:33:71:77:a8:25:ee:8f:e1:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3707228a2ebf2c43b4415f337177a825ee8fe108/; sid:903200432; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"da:6f:f7:d6:34:3c:a2:18:e7:1f:ce:ff:e1:c8:44:98:15:5f:26:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da6ff7d6343ca218e71fceffe1c84498155f2671/; sid:903200433; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"1c:3b:c6:ee:bb:13:6c:6c:cc:af:bd:2f:86:f6:92:10:d3:50:1a:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c3bc6eebb136c6cccafbd2f86f69210d3501ade/; sid:903200434; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"a0:60:d4:3f:58:4a:7d:2f:83:8b:6d:64:af:f4:07:6d:f7:66:a1:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a060d43f584a7d2f838b6d64aff4076df766a1b9/; sid:903200435; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e4:38:5d:6d:86:14:c0:19:e9:20:b8:b3:65:0b:aa:36:54:b6:f1:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e4385d6d8614c019e920b8b3650baa3654b6f17b/; sid:903200436; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a4:8a:dd:c4:95:83:a5:fa:52:a2:34:b1:48:f8:16:13:38:e2:76:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a48addc49583a5fa52a234b148f8161338e27617/; sid:903200437; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:49:77:b9:06:34:9c:aa:ad:8a:fa:2a:88:84:dd:29:50:ef:da:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef4977b906349caaad8afa2a8884dd2950efda5f/; sid:903200438; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c5:16:d4:4f:19:2c:7e:72:9f:f9:31:55:f3:57:cc:58:2c:f3:b5:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c516d44f192c7e729ff93155f357cc582cf3b57b/; sid:903200439; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6f:c7:fe:77:aa:ac:09:d0:78:cb:50:03:9e:c5:07:f9:64:08:25:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fc7fe77aaac09d078cb50039ec507f964082583/; sid:903200440; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"80:00:f0:35:54:af:7c:c9:fe:d8:35:1f:33:e4:21:b0:bd:37:09:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8000f03554af7cc9fed8351f33e421b0bd37095d/; sid:903200441; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b5:84:2e:89:2e:61:be:e8:44:e3:0e:18:2c:76:24:3f:26:af:3e:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5842e892e61bee844e30e182c76243f26af3eed/; sid:903200442; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1f:ca:dc:65:37:b3:65:be:3a:e9:fb:fb:7d:60:09:8b:9e:2d:e3:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fcadc6537b365be3ae9fbfb7d60098b9e2de3d2/; sid:903200443; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (URLzone C&C)"; tls_cert_fingerprint; content:"88:79:53:50:50:fd:1e:97:2c:eb:9c:42:b7:17:e6:6a:c6:c6:77:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8879535050fd1e972ceb9c42b717e66ac6c677ea/; sid:903200444; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:66:5d:2d:cd:5b:06:c8:c1:3d:aa:53:d2:f0:e0:8b:0d:27:39:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9665d2dcd5b06c8c13daa53d2f0e08b0d27398f/; sid:903200445; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f9:95:d2:f8:ae:c2:f6:1d:f3:a2:0c:1f:79:3f:c3:be:d7:ad:8b:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f995d2f8aec2f61df3a20c1f793fc3bed7ad8b17/; sid:903200446; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:04:0d:10:2d:b2:f8:6e:04:0c:59:ba:39:07:d5:87:47:66:c2:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06040d102db2f86e040c59ba3907d5874766c2fe/; sid:903200447; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"22:83:5d:47:11:26:0c:fc:cf:64:4e:12:0f:00:72:22:ca:02:89:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22835d4711260cfccf644e120f007222ca02896a/; sid:903200448; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:3f:ff:43:29:96:f0:50:cf:f7:30:4b:0b:74:f5:24:8c:e0:c0:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/453fff432996f050cff7304b0b74f5248ce0c036/; sid:903200449; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"99:d9:d0:1f:47:81:e0:e4:d1:b2:a7:3c:fd:d6:aa:02:6a:8d:2c:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99d9d01f4781e0e4d1b2a73cfdd6aa026a8d2ca9/; sid:903200450; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"9d:95:f5:40:06:41:b5:77:38:00:e4:ad:17:7a:04:ca:d2:3f:cb:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d95f5400641b5773800e4ad177a04cad23fcb0e/; sid:903200451; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"e9:06:41:28:b5:5d:fa:f0:7a:cb:7a:ae:0f:cd:76:28:09:00:82:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9064128b55dfaf07acb7aae0fcd7628090082e2/; sid:903200452; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"a8:fb:10:cb:9a:22:23:72:64:6f:0b:7b:3a:6e:4d:22:8e:f2:54:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a8fb10cb9a222372646f0b7b3a6e4d228ef254d3/; sid:903200453; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"9e:dc:51:f3:bc:90:0c:7e:ff:23:42:76:d5:d9:8b:58:05:64:4e:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9edc51f3bc900c7eff234276d5d98b5805644e12/; sid:903200454; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"66:a6:06:ec:3f:33:58:d2:c0:59:1f:cb:67:c2:31:15:0c:6e:0c:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66a606ec3f3358d2c0591fcb67c231150c6e0cff/; sid:903200455; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"79:c5:db:e0:7d:5e:14:a3:82:98:79:16:a2:d9:ee:af:c4:1d:14:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79c5dbe07d5e14a382987916a2d9eeafc41d1441/; sid:903200456; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:66:36:72:e3:46:b9:1c:83:c3:bc:e7:4c:fa:14:09:8c:7e:44:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77663672e346b91c83c3bce74cfa14098c7e445c/; sid:903200457; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"eb:30:fa:30:a7:67:2b:b5:9f:d5:f8:18:68:4f:5a:17:05:47:8f:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb30fa30a7672bb59fd5f818684f5a1705478f8a/; sid:903200458; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"74:5d:36:f3:e1:ca:7f:ec:7f:b3:a4:9e:cf:05:77:b9:58:4f:26:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/745d36f3e1ca7fec7fb3a49ecf0577b9584f2611/; sid:903200459; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ab:97:71:87:48:d7:9a:4c:f9:00:b0:35:4b:e1:ae:9a:81:b4:d0:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab97718748d79a4cf900b0354be1ae9a81b4d05a/; sid:903200460; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"62:48:f3:db:15:be:70:ce:eb:c2:1c:91:62:fb:af:71:4b:1b:c8:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6248f3db15be70ceebc21c9162fbaf714b1bc828/; sid:903200461; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"90:44:95:e3:01:22:d3:7a:39:06:3b:cb:10:ba:ee:db:3b:ca:3a:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/904495e30122d37a39063bcb10baeedb3bca3ae8/; sid:903200462; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b4:95:26:5f:c8:f9:96:6e:bd:9d:f7:58:9a:14:65:9e:91:ea:e6:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b495265fc8f9966ebd9df7589a14659e91eae6e4/; sid:903200463; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"28:d4:1a:17:8f:3b:b4:56:35:57:59:c2:f2:fe:97:28:d1:32:6d:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28d41a178f3bb456355759c2f2fe9728d1326d89/; sid:903200464; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"15:cc:6b:ca:1f:1e:ee:15:76:92:4b:ca:a9:3d:8a:f2:9f:25:95:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15cc6bca1f1eee1576924bcaa93d8af29f259512/; sid:903200465; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"c9:be:dd:d9:e8:61:e8:01:f9:db:a5:36:d6:64:2b:03:35:fa:9a:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9beddd9e861e801f9dba536d6642b0335fa9ae2/; sid:903200466; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ab:e4:dc:7a:9c:30:07:9a:7c:3a:ff:46:03:f9:b1:fb:28:75:65:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/abe4dc7a9c30079a7c3aff4603f9b1fb28756548/; sid:903200467; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5f:0d:1d:72:50:d7:be:fb:91:8b:b4:7e:fa:9c:75:ed:05:6d:e1:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f0d1d7250d7befb918bb47efa9c75ed056de188/; sid:903200468; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f0:f4:f4:39:f6:4b:13:a4:4c:2a:74:9f:0e:95:21:5a:bb:29:4d:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0f4f439f64b13a44c2a749f0e95215abb294de0/; sid:903200469; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f7:5f:18:9d:71:ea:ba:d8:7e:b8:88:18:f5:66:a1:ea:96:da:0c:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f75f189d71eabad87eb88818f566a1ea96da0c67/; sid:903200470; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"97:ff:7b:e1:c1:d9:ac:2b:ea:ce:12:2d:d4:63:a2:f7:aa:2d:f5:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97ff7be1c1d9ac2beace122dd463a2f7aa2df5d7/; sid:903200471; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d9:19:06:10:dd:07:25:db:8e:d2:25:89:e5:16:f5:40:78:a0:84:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9190610dd0725db8ed22589e516f54078a08402/; sid:903200472; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d8:6d:c7:2a:a6:41:bb:dc:ee:8e:f7:ea:c4:a8:7a:67:cb:6d:eb:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d86dc72aa641bbdcee8ef7eac4a87a67cb6deb71/; sid:903200473; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:77:70:50:b2:8f:31:b8:4b:d2:78:05:1e:9e:4a:39:1a:14:52:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15777050b28f31b84bd278051e9e4a391a145237/; sid:903200474; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e0:43:57:f4:44:91:51:ec:42:01:13:ca:90:96:64:57:9c:cc:2b:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e04357f4449151ec420113ca909664579ccc2b45/; sid:903200475; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"de:98:0d:b3:a9:f4:c4:fe:34:d8:ab:ed:0e:ae:96:53:cc:83:20:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de980db3a9f4c4fe34d8abed0eae9653cc83206e/; sid:903200476; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ad:09:e4:2a:d8:62:e9:f6:b5:3f:ee:3d:f0:aa:bd:9b:0c:b9:33:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ad09e42ad862e9f6b53fee3df0aabd9b0cb933c7/; sid:903200477; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1f:f6:15:65:f9:df:63:c8:53:01:5b:b2:30:58:18:6b:6c:60:a2:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ff61565f9df63c853015bb23058186b6c60a221/; sid:903200478; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"33:fe:78:09:ab:2d:77:cc:ea:19:e1:12:5f:b3:64:63:22:a9:40:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33fe7809ab2d77ccea19e1125fb3646322a940de/; sid:903200479; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"c8:40:1f:25:32:2f:66:07:e5:bc:12:2c:de:ce:95:c2:cc:b8:15:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8401f25322f6607e5bc122cdece95c2ccb8157b/; sid:903200480; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:b8:61:6d:11:6b:0b:cf:ee:fc:3a:1b:15:dd:e6:e0:04:f8:cc:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ceb8616d116b0bcfeefc3a1b15dde6e004f8cc1a/; sid:903200481; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:6a:4e:a8:03:df:4d:10:e6:61:eb:b5:6d:80:11:91:f1:36:1f:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a6a4ea803df4d10e661ebb56d801191f1361f85/; sid:903200482; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ed:cc:10:3b:b4:e4:6e:06:33:5f:27:c6:a1:7a:4d:90:19:b5:30:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/edcc103bb4e46e06335f27c6a17a4d9019b5303f/; sid:903200483; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"35:d5:b5:e8:2c:f6:3f:0c:d4:7f:61:54:da:2e:98:41:1c:11:8d:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35d5b5e82cf63f0cd47f6154da2e98411c118d7c/; sid:903200484; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"35:83:d5:1f:40:32:9a:49:28:2b:52:ba:fc:82:51:d5:55:31:fa:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3583d51f40329a49282b52bafc8251d55531faa1/; sid:903200485; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b1:0e:88:78:f9:db:24:8f:76:33:d3:56:9d:37:e4:83:c9:f9:6a:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b10e8878f9db248f7633d3569d37e483c9f96a7c/; sid:903200486; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"40:e7:43:05:79:0c:9e:5b:76:11:56:74:61:26:d9:61:d0:29:23:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/40e74305790c9e5b761156746126d961d029231c/; sid:903200487; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"24:33:7a:9f:03:cf:23:b9:64:52:b1:9c:0d:1f:2e:10:5e:ea:f3:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24337a9f03cf23b96452b19c0d1f2e105eeaf3f2/; sid:903200488; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"10:ee:62:a1:a2:d3:69:e3:a5:b5:5f:7c:71:27:3a:fd:42:4f:08:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10ee62a1a2d369e3a5b55f7c71273afd424f08d0/; sid:903200489; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"09:1e:d0:a8:eb:aa:cf:33:67:75:5c:39:a0:4b:e6:9f:d7:aa:fc:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/091ed0a8ebaacf3367755c39a04be69fd7aafc57/; sid:903200490; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3a:b5:71:e1:e3:dd:b3:c0:b7:17:5d:75:eb:23:8e:6c:69:39:0b:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ab571e1e3ddb3c0b7175d75eb238e6c69390b4b/; sid:903200491; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ee:14:e4:ab:0b:24:3b:39:73:15:e0:94:93:5f:5b:74:a6:7a:1b:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee14e4ab0b243b397315e094935f5b74a67a1bc7/; sid:903200492; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fa:ae:5e:0e:b6:41:f1:eb:53:02:1a:6d:1b:38:b9:fd:ce:be:a8:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/faae5e0eb641f1eb53021a6d1b38b9fdcebea8a4/; sid:903200493; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b2:1c:95:17:c2:f5:3c:eb:db:f1:f0:a1:a7:82:52:a4:75:b7:9d:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b21c9517c2f53cebdbf1f0a1a78252a475b79d61/; sid:903200494; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:ab:47:e5:22:c3:b5:60:06:18:42:7d:b5:c5:70:a0:cf:2f:1d:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/45ab47e522c3b5600618427db5c570a0cf2f1db7/; sid:903200495; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"93:d8:98:7e:b1:ca:50:c3:33:6a:a7:82:58:50:3f:8f:24:b1:6b:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93d8987eb1ca50c3336aa78258503f8f24b16bb7/; sid:903200496; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1e:a6:cd:bb:0e:9f:e7:84:f4:82:b3:30:ea:1d:ab:af:de:31:c8:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ea6cdbb0e9fe784f482b330ea1dabafde31c80f/; sid:903200497; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0b:f4:17:e3:aa:ee:82:0b:c6:3a:92:b3:d7:56:aa:cd:d5:ab:3b:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0bf417e3aaee820bc63a92b3d756aacdd5ab3b6b/; sid:903200498; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"23:1a:ba:69:dc:9e:f4:b0:c6:1c:9f:c0:3e:ef:37:f6:e7:8d:8b:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/231aba69dc9ef4b0c61c9fc03eef37f6e78d8b07/; sid:903200499; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:23:b6:60:99:9d:e4:2f:be:72:b0:40:a4:dd:48:9e:46:2a:64:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c723b660999de42fbe72b040a4dd489e462a6407/; sid:903200500; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"7b:33:53:c2:05:15:5b:2a:a6:53:35:12:74:a4:bf:a8:3b:1c:2b:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b3353c205155b2aa653351274a4bfa83b1c2b62/; sid:903200501; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"db:49:fc:d4:49:e1:b2:14:df:69:39:e1:69:16:de:f5:06:cc:aa:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db49fcd449e1b214df6939e16916def506ccaacb/; sid:903200502; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"f2:6e:1b:10:fd:c4:1c:56:9a:7f:ae:19:b8:f8:46:43:64:12:97:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f26e1b10fdc41c569a7fae19b8f84643641297a0/; sid:903200503; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"81:7f:60:e0:ce:d4:15:d1:7a:26:9d:b2:f9:b7:b3:0f:25:b1:10:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/817f60e0ced415d17a269db2f9b7b30f25b110d1/; sid:903200504; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0b:2d:46:9d:03:93:71:c3:bc:c2:be:00:c9:a9:f4:17:84:09:2c:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b2d469d039371c3bcc2be00c9a9f41784092ced/; sid:903200505; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"df:62:ac:9a:fd:be:a3:06:ff:d2:ce:eb:c9:cf:11:84:66:71:3e:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/df62ac9afdbea306ffd2ceebc9cf118466713e6e/; sid:903200506; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c0:34:ba:b6:7b:6d:cb:77:63:89:b7:74:4d:78:ab:14:82:de:4c:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c034bab67b6dcb776389b7744d78ab1482de4cfb/; sid:903200507; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e7:ca:9d:1b:7f:12:68:b7:a8:b5:18:00:9c:db:7b:01:cd:04:bf:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7ca9d1b7f1268b7a8b518009cdb7b01cd04bf7d/; sid:903200508; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"74:2d:e1:81:8c:41:b6:63:96:ed:96:28:6e:60:1c:3a:58:33:69:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/742de1818c41b66396ed96286e601c3a58336950/; sid:903200509; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:b0:ff:55:4b:64:9e:e6:db:9f:e6:bc:23:ec:2b:7d:56:1a:72:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32b0ff554b649ee6db9fe6bc23ec2b7d561a7276/; sid:903200510; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:9d:5e:e8:0e:79:05:8e:35:ca:9d:ae:77:52:fe:40:7d:60:f8:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c79d5ee80e79058e35ca9dae7752fe407d60f8c6/; sid:903200511; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:b0:e8:96:42:bb:b6:0b:69:8f:16:61:c1:53:6c:0e:46:72:9d:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6b0e89642bbb60b698f1661c1536c0e46729d8c/; sid:903200512; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:7b:76:81:f2:a8:5d:9c:8d:f7:e8:0b:8d:ea:f1:ac:2b:92:e5:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a67b7681f2a85d9c8df7e80b8deaf1ac2b92e5cb/; sid:903200513; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d0:b3:d0:f1:04:33:9b:b2:8e:f3:f1:6e:6a:32:1f:44:61:34:11:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0b3d0f104339bb28ef3f16e6a321f44613411a7/; sid:903200514; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ba:a0:45:6c:53:39:b1:d1:f8:8a:92:b0:77:ce:09:b4:2c:69:15:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/baa0456c5339b1d1f88a92b077ce09b42c6915c4/; sid:903200515; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"83:53:6e:03:92:e3:bf:a7:8a:09:0f:74:9e:00:71:6a:ee:47:f1:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/83536e0392e3bfa78a090f749e00716aee47f192/; sid:903200516; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e1:bc:1a:01:09:68:a6:54:9f:67:c3:08:ef:77:9d:49:99:e0:c6:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1bc1a010968a6549f67c308ef779d4999e0c687/; sid:903200517; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c0:d8:ce:57:5c:67:97:35:65:17:d8:49:1a:83:d3:06:1d:b6:32:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0d8ce575c6797356517d8491a83d3061db6323b/; sid:903200518; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5b:8a:6e:1e:07:14:fd:71:83:60:92:fb:be:bf:49:24:3a:97:a3:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b8a6e1e0714fd71836092fbbebf49243a97a376/; sid:903200519; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:de:99:5a:24:69:c6:fd:5f:43:4b:1e:9a:32:87:99:55:89:26:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52de995a2469c6fd5f434b1e9a328799558926c9/; sid:903200520; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"55:ac:d5:43:d5:6a:be:c1:95:6f:2d:5a:0b:29:e1:19:bd:d8:a0:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55acd543d56abec1956f2d5a0b29e119bdd8a0e6/; sid:903200521; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b1:0c:7d:8d:08:29:5f:4f:67:38:64:6d:a8:c1:dc:d0:c3:bb:fd:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b10c7d8d08295f4f6738646da8c1dcd0c3bbfd5f/; sid:903200522; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"18:ba:0e:66:d5:ee:92:1e:ae:0c:ee:4d:2e:d0:bb:fa:9a:6a:5b:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18ba0e66d5ee921eae0cee4d2ed0bbfa9a6a5b07/; sid:903200523; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"3e:34:0d:99:e7:4c:1f:8d:ee:34:11:c6:4d:d6:ea:81:09:93:2a:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e340d99e74c1f8dee3411c64dd6ea8109932af6/; sid:903200524; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"8c:8e:66:96:1f:f0:98:41:52:9b:b7:bc:1f:09:1f:1e:7e:d8:ef:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c8e66961ff09841529bb7bc1f091f1e7ed8ef7a/; sid:903200525; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:b8:b7:ab:d0:7e:7d:b8:75:d5:c2:49:5f:50:74:d1:bc:14:97:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43b8b7abd07e7db875d5c2495f5074d1bc1497c9/; sid:903200526; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0d:ee:2d:a9:fc:68:30:90:18:44:64:da:30:44:ff:12:96:9e:76:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dee2da9fc683090184464da3044ff12969e76d8/; sid:903200527; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dc:9d:fd:a5:14:6d:ce:11:bd:46:bc:47:52:79:8e:43:a5:ed:f9:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc9dfda5146dce11bd46bc4752798e43a5edf9d1/; sid:903200528; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e8:4a:7f:1d:e9:75:66:78:ae:f5:10:89:4b:4e:5d:6d:5c:10:ee:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e84a7f1de9756678aef510894b4e5d6d5c10ee3c/; sid:903200529; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3d:74:1f:f6:72:58:60:f0:b4:06:f4:34:be:a7:8c:f9:ea:71:05:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3d741ff6725860f0b406f434bea78cf9ea71059b/; sid:903200530; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"26:62:e2:32:d7:da:6e:f5:21:3e:36:22:75:a0:5f:c2:36:ad:9e:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2662e232d7da6ef5213e362275a05fc236ad9e95/; sid:903200531; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5a:c8:25:9f:39:89:ba:8c:51:5f:6c:a9:70:61:36:8f:5b:ab:21:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ac8259f3989ba8c515f6ca97061368f5bab216d/; sid:903200532; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"80:ff:fe:d8:49:f6:15:fd:53:1d:74:e5:e6:b3:26:e4:f0:18:df:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80fffed849f615fd531d74e5e6b326e4f018dfc6/; sid:903200533; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"9e:86:13:8b:10:96:0d:54:b3:f7:1b:87:d6:bf:c1:59:82:da:9c:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e86138b10960d54b3f71b87d6bfc15982da9c71/; sid:903200534; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dc:0b:37:2e:de:bd:eb:bf:28:29:99:87:4e:91:a1:39:e0:53:80:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc0b372edebdebbf282999874e91a139e0538006/; sid:903200535; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"72:89:4e:2a:58:90:e7:60:5e:82:ef:bd:83:ea:b6:93:c3:1a:e3:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72894e2a5890e7605e82efbd83eab693c31ae363/; sid:903200536; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a1:95:7e:2d:fc:19:e1:bb:4c:00:7c:af:29:92:3f:79:f4:27:a4:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a1957e2dfc19e1bb4c007caf29923f79f427a454/; sid:903200537; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"09:82:f8:4f:7b:7f:a7:c4:3a:01:2c:62:c3:ee:a6:a9:6c:08:1a:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0982f84f7b7fa7c43a012c62c3eea6a96c081a54/; sid:903200538; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9a:27:ca:bc:e7:43:85:be:bf:0e:9e:41:d8:34:e9:c1:ed:22:39:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a27cabce74385bebf0e9e41d834e9c1ed223985/; sid:903200539; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"83:a4:19:c1:b4:9a:13:f1:34:a8:0f:c8:af:96:88:69:16:3f:80:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/83a419c1b49a13f134a80fc8af968869163f8022/; sid:903200540; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"61:17:28:f5:23:c6:32:70:4d:53:75:1a:5c:42:ba:f6:51:77:d3:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/611728f523c632704d53751a5c42baf65177d30d/; sid:903200541; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f9:c0:6e:bd:72:8d:0a:14:0e:4d:89:9a:db:95:d9:76:93:44:5c:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f9c06ebd728d0a140e4d899adb95d97693445c2b/; sid:903200542; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"de:ae:cc:4f:ca:be:ab:05:a4:fd:7a:8e:2f:63:16:c9:74:be:6a:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/deaecc4fcabeab05a4fd7a8e2f6316c974be6a40/; sid:903200543; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"6d:98:de:4a:ab:c3:3b:d1:05:28:b7:3b:63:3a:d4:9c:e2:4f:57:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d98de4aabc33bd10528b73b633ad49ce24f5704/; sid:903200544; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a0:34:09:58:22:b2:cf:fb:eb:96:35:32:1d:c5:24:a5:7e:03:bb:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a034095822b2cffbeb9635321dc524a57e03bb64/; sid:903200545; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"8d:68:01:db:f5:3b:1e:0e:90:42:b6:d4:63:b5:18:00:f4:32:5d:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d6801dbf53b1e0e9042b6d463b51800f4325d42/; sid:903200546; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"17:b2:d2:6a:23:5d:92:f3:1a:99:2f:85:f2:48:3d:7f:fa:6d:21:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17b2d26a235d92f31a992f85f2483d7ffa6d2109/; sid:903200547; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"af:c7:31:e5:e4:e6:36:a7:0e:20:78:38:2c:ce:17:0e:f8:3d:93:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/afc731e5e4e636a70e2078382cce170ef83d93f6/; sid:903200548; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"68:f0:a2:ef:0a:7e:ad:c2:e0:55:20:33:27:30:9b:a7:ab:db:8b:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68f0a2ef0a7eadc2e055203327309ba7abdb8b61/; sid:903200549; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"33:3e:21:5f:80:54:80:e6:de:39:23:1b:96:fe:6a:64:e9:61:1a:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/333e215f805480e6de39231b96fe6a64e9611a22/; sid:903200550; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"df:78:b0:19:bc:29:8b:c9:72:17:be:e6:23:27:fc:c6:97:0a:e4:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/df78b019bc298bc97217bee62327fcc6970ae454/; sid:903200551; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ec:e7:82:a8:8b:93:78:cb:bf:de:68:e0:4c:05:dd:38:d3:a0:c0:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ece782a88b9378cbbfde68e04c05dd38d3a0c083/; sid:903200552; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:4d:11:4b:d3:4c:45:31:d0:29:9c:45:68:de:78:82:58:27:62:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/064d114bd34c4531d0299c4568de78825827622b/; sid:903200553; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8e:ed:a1:8c:f9:78:e7:8b:71:c6:79:f3:7b:d4:88:69:f0:c6:fd:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8eeda18cf978e78b71c679f37bd48869f0c6fd2a/; sid:903200554; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"af:8a:fb:ec:4b:5d:44:13:db:8d:55:cc:db:53:53:62:80:c9:0e:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af8afbec4b5d4413db8d55ccdb53536280c90eca/; sid:903200555; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f7:21:1b:18:8b:6a:23:41:b6:19:d6:0e:99:be:44:89:18:98:aa:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f7211b188b6a2341b619d60e99be44891898aacd/; sid:903200556; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0e:da:9c:1b:f5:f4:ac:1f:5b:d4:4e:b9:3d:8e:7b:f0:ac:f3:a6:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0eda9c1bf5f4ac1f5bd44eb93d8e7bf0acf3a691/; sid:903200557; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e1:44:d9:51:84:b1:3e:6f:3b:86:a7:ad:d4:d4:68:7d:ec:ef:b7:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e144d95184b13e6f3b86a7add4d4687decefb775/; sid:903200558; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"90:e1:fa:60:b7:2f:0a:d0:e0:96:4e:d4:0c:dc:ba:c7:5b:4c:53:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/90e1fa60b72f0ad0e0964ed40cdcbac75b4c53ee/; sid:903200559; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"f9:3a:7f:2c:a1:46:31:40:ca:6d:7e:f4:cd:6b:11:67:4e:86:9f:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f93a7f2ca1463140ca6d7ef4cd6b11674e869fb5/; sid:903200560; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"16:a9:f4:dd:4f:35:98:b6:cf:ed:52:bf:b1:07:6c:99:0c:cd:b4:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/16a9f4dd4f3598b6cfed52bfb1076c990ccdb451/; sid:903200561; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"18:39:8c:aa:d8:e2:f8:68:a6:9d:e8:dc:e0:7f:1e:cc:07:55:a3:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18398caad8e2f868a69de8dce07f1ecc0755a32c/; sid:903200562; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1e:3a:36:9a:a3:16:16:2e:31:b7:7d:67:90:37:0f:a9:91:3b:81:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e3a369aa316162e31b77d6790370fa9913b8129/; sid:903200563; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"74:9a:64:dc:10:32:e0:b0:e7:33:37:07:52:e3:5c:0e:61:50:b3:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/749a64dc1032e0b0e733370752e35c0e6150b36e/; sid:903200564; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"eb:f5:c5:c6:13:40:0d:9b:16:8b:71:13:95:e8:c5:a6:a1:64:7e:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ebf5c5c613400d9b168b711395e8c5a6a1647e6a/; sid:903200565; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4b:05:9a:6d:dd:ed:fc:62:a0:05:84:47:86:72:fa:cb:d9:f2:e3:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4b059a6dddedfc62a00584478672facbd9f2e3fc/; sid:903200566; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5e:7c:23:95:41:ad:a7:23:0e:39:b6:fc:2e:61:b6:7f:fd:e9:10:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e7c239541ada7230e39b6fc2e61b67ffde91007/; sid:903200567; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"69:dd:95:de:03:db:de:5e:b2:0f:ef:55:99:65:fe:d5:2f:7d:e1:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69dd95de03dbde5eb20fef559965fed52f7de1a6/; sid:903200568; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ad:93:01:53:6b:b9:4d:13:21:1c:f3:f7:ed:3e:13:0d:29:51:19:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ad9301536bb94d13211cf3f7ed3e130d295119bb/; sid:903200569; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"99:b5:cd:c1:50:38:99:e6:53:2e:e8:2d:dc:2e:42:d5:9b:cb:62:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99b5cdc1503899e6532ee82ddc2e42d59bcb6284/; sid:903200570; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dc:dc:9d:5c:a9:4a:aa:2b:39:78:8c:7b:67:5e:b2:43:12:72:60:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dcdc9d5ca94aaa2b39788c7b675eb243127260ee/; sid:903200571; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3c:77:21:8c:95:f0:42:53:02:92:b8:41:a2:88:77:23:e0:d0:21:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c77218c95f042530292b841a2887723e0d02140/; sid:903200572; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6c:31:e6:10:3f:87:93:43:55:f7:dc:02:ef:9e:d4:86:bf:52:e2:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6c31e6103f87934355f7dc02ef9ed486bf52e2da/; sid:903200573; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"e1:b8:af:16:6d:6e:0e:1c:89:9a:97:d5:05:18:da:ff:e6:95:12:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1b8af166d6e0e1c899a97d50518daffe69512d1/; sid:903200574; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"09:64:b8:56:b1:cb:35:9a:fb:5a:f8:7f:d6:f7:31:c8:70:c4:8d:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0964b856b1cb359afb5af87fd6f731c870c48d00/; sid:903200575; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"d3:51:60:25:e2:4d:d3:fd:8f:d4:4a:91:15:82:43:cc:53:f0:c5:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3516025e24dd3fd8fd44a91158243cc53f0c547/; sid:903200576; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"2e:f0:06:ec:84:c0:e6:ba:ac:9a:bb:9c:58:5a:97:d4:c4:32:13:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2ef006ec84c0e6baac9abb9c585a97d4c43213f6/; sid:903200577; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"86:7f:3d:92:48:28:f9:3b:0b:d3:06:41:df:b0:1d:51:35:1a:ea:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/867f3d924828f93b0bd30641dfb01d51351aeac9/; sid:903200578; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7c:6b:fe:ac:60:44:09:17:13:8d:95:72:57:1e:ad:8a:77:2c:18:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c6bfeac60440917138d9572571ead8a772c184e/; sid:903200579; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"71:0a:38:7e:98:a6:02:ca:0b:30:97:ff:d3:ee:f2:13:5c:23:e5:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/710a387e98a602ca0b3097ffd3eef2135c23e5fb/; sid:903200580; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"38:17:2a:66:a2:a6:d7:e9:9a:31:73:90:b7:5c:6a:d9:a9:bd:b8:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38172a66a2a6d7e99a317390b75c6ad9a9bdb8e7/; sid:903200581; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d9:f5:2c:1e:e0:27:70:88:b7:14:1e:d9:7f:86:ea:0b:9f:b6:f1:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9f52c1ee0277088b7141ed97f86ea0b9fb6f1ce/; sid:903200582; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f3:54:fb:31:b5:0a:0d:8c:d1:4d:1a:d0:12:e5:d3:5d:e0:7e:02:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f354fb31b50a0d8cd14d1ad012e5d35de07e021a/; sid:903200583; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ae:c5:04:81:bf:00:a4:b4:c3:b5:69:5e:ce:99:2c:b0:34:50:7b:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aec50481bf00a4b4c3b5695ece992cb034507bd4/; sid:903200584; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"48:b9:56:40:72:a6:16:60:bb:62:0b:ba:e4:31:55:85:24:cd:a7:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/48b9564072a61660bb620bbae431558524cda74f/; sid:903200585; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"9c:c9:3e:0a:dd:5e:fd:f4:3b:c5:66:83:6e:56:66:d7:04:97:01:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9cc93e0add5efdf43bc566836e5666d7049701ed/; sid:903200586; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Redyms C&C)"; tls_cert_fingerprint; content:"d3:9d:27:d2:26:7c:5e:3c:26:38:26:99:e0:38:be:6e:92:70:dc:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d39d27d2267c5e3c26382699e038be6e9270dc13/; sid:903200587; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"57:0d:fd:12:b4:07:69:5c:2a:04:6c:d2:ca:f5:ce:a4:11:42:06:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/570dfd12b407695c2a046cd2caf5cea41142066e/; sid:903200588; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4f:7f:85:31:cf:37:5b:27:59:da:14:d3:a3:a2:ba:b3:0b:cc:ff:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4f7f8531cf375b2759da14d3a3a2bab30bccffad/; sid:903200589; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"08:da:58:00:56:f6:ac:08:67:6a:41:74:68:65:8e:ff:21:1f:02:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08da580056f6ac08676a417468658eff211f02db/; sid:903200590; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:ce:b8:4d:e2:d5:05:eb:74:88:de:ce:12:86:e4:17:a8:8b:01:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1ceb84de2d505eb7488dece1286e417a88b016a/; sid:903200591; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fd:17:ec:09:74:13:3c:75:df:d9:74:62:1c:25:20:97:be:33:a7:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd17ec0974133c75dfd974621c252097be33a71a/; sid:903200592; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"39:ad:79:bf:72:41:47:5b:72:54:30:05:34:92:ed:28:ba:cd:c9:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39ad79bf7241475b725430053492ed28bacdc9f9/; sid:903200593; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ee:de:ee:24:4a:d5:8b:b6:2a:9e:a0:2c:77:9e:fa:b8:cb:ec:c4:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eedeee244ad58bb62a9ea02c779efab8cbecc4c0/; sid:903200594; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f6:96:b1:94:3c:15:27:bf:1e:c6:c7:03:46:a6:f0:a8:20:e7:3c:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f696b1943c1527bf1ec6c70346a6f0a820e73cd3/; sid:903200595; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:e5:5c:3c:54:59:11:a8:ff:f9:3a:32:8b:98:5c:a9:2c:fb:50:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a4e55c3c545911a8fff93a328b985ca92cfb5045/; sid:903200596; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"6f:b2:3d:09:fa:94:6b:5f:ef:10:90:f9:52:70:29:33:41:45:47:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fb23d09fa946b5fef1090f952702933414547f9/; sid:903200597; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"a5:82:2f:2b:ea:bc:6f:ac:c3:69:32:8e:3d:81:36:d1:10:61:46:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5822f2beabc6facc369328e3d8136d110614635/; sid:903200598; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a7:09:c2:5c:60:7b:05:0b:2a:cb:b9:89:96:c6:3b:8e:91:3a:70:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a709c25c607b050b2acbb98996c63b8e913a7082/; sid:903200599; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:71:f1:a7:01:01:3b:48:af:ea:90:8c:f6:a2:fc:4b:b8:b4:10:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8571f1a701013b48afea908cf6a2fc4bb8b410fa/; sid:903200600; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex)"; tls_cert_fingerprint; content:"a6:d8:1e:31:cc:fd:c5:eb:a7:4a:ce:29:02:ca:f2:3d:9d:9a:91:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6d81e31ccfdc5eba74ace2902caf23d9d9a912f/; sid:903200601; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"81:4c:ae:81:0c:29:fd:37:d7:5c:a2:65:7d:73:a0:d3:5c:28:40:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/814cae810c29fd37d75ca2657d73a0d35c2840d8/; sid:903200602; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:65:59:9c:76:15:10:f9:9b:95:98:7f:42:b6:20:9e:5e:6f:44:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e265599c761510f99b95987f42b6209e5e6f4485/; sid:903200603; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:d0:50:94:69:39:f8:4c:48:ac:24:9b:cb:c6:e1:65:51:b5:c9:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31d050946939f84c48ac249bcbc6e16551b5c9fd/; sid:903200604; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8b:14:c8:c8:42:40:89:82:15:cf:30:6e:66:88:fd:a4:38:74:1a:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b14c8c84240898215cf306e6688fda438741ae1/; sid:903200605; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1d:9d:3a:a6:21:b6:cc:83:8d:31:d0:b2:68:8f:a0:4a:0d:03:06:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d9d3aa621b6cc838d31d0b2688fa04a0d030669/; sid:903200606; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"83:7c:72:56:f9:42:bd:56:3c:6c:16:7b:40:84:02:5a:4a:e1:0b:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/837c7256f942bd563c6c167b4084025a4ae10bae/; sid:903200607; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cb:7e:fc:25:c9:71:bc:44:a5:68:af:3d:66:51:d8:a2:24:43:9f:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb7efc25c971bc44a568af3d6651d8a224439f62/; sid:903200608; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0e:cb:00:b9:fb:08:5b:96:71:05:8d:f0:90:09:56:d8:ca:e9:8c:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ecb00b9fb085b9671058df0900956d8cae98c3f/; sid:903200609; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"18:39:1d:14:16:4e:a2:ba:c3:b2:a8:62:98:ba:54:e9:ac:4d:12:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18391d14164ea2bac3b2a86298ba54e9ac4d128a/; sid:903200610; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"34:b8:d2:b0:9c:ed:8e:d1:83:d8:9a:df:af:2c:1b:40:bb:2d:0e:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34b8d2b09ced8ed183d89adfaf2c1b40bb2d0e64/; sid:903200611; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1e:99:67:d3:e5:dc:bd:e8:de:bd:27:a7:92:22:a0:93:ef:8e:4e:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e9967d3e5dcbde8debd27a79222a093ef8e4e65/; sid:903200612; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"84:0f:a7:44:94:3b:03:c7:81:20:c6:64:91:2b:26:ac:51:ed:1e:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/840fa744943b03c78120c664912b26ac51ed1e74/; sid:903200613; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6a:35:13:d6:09:ea:9b:59:53:6b:cb:86:75:dc:3a:22:b6:89:86:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a3513d609ea9b59536bcb8675dc3a22b689861b/; sid:903200614; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bd:74:f3:6b:99:c2:2b:c3:11:38:87:c8:14:d8:31:cd:99:ac:12:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bd74f36b99c22bc3113887c814d831cd99ac1223/; sid:903200615; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"53:39:71:78:7f:4a:42:c8:b4:c3:0b:13:22:05:8d:83:38:aa:61:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/533971787f4a42c8b4c30b1322058d8338aa6144/; sid:903200616; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f8:e9:97:67:30:d2:d4:ef:b2:22:6c:ce:b6:b6:41:7f:f5:89:d4:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f8e9976730d2d4efb2226cceb6b6417ff589d411/; sid:903200617; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b1:af:aa:f4:10:03:bc:8b:cc:b4:95:1f:89:b0:35:f6:ae:c7:83:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1afaaf41003bc8bccb4951f89b035f6aec78373/; sid:903200618; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"96:9c:33:c3:26:9f:34:9a:78:fd:b9:f8:58:9b:c5:dd:a3:14:93:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/969c33c3269f349a78fdb9f8589bc5dda314930f/; sid:903200619; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"be:c4:80:58:87:ed:c1:28:07:3c:39:17:48:89:36:85:27:61:67:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bec4805887edc128073c39174889368527616761/; sid:903200620; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"20:18:6c:e2:50:bb:de:dd:67:6c:45:8e:61:ae:9c:24:5b:1b:ff:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20186ce250bbdedd676c458e61ae9c245b1bff0c/; sid:903200621; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fd:ba:cd:06:0f:6a:e2:a2:8b:41:c7:6e:9b:d9:93:4f:c6:d0:b3:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fdbacd060f6ae2a28b41c76e9bd9934fc6d0b329/; sid:903200622; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7a:04:d2:da:1d:f0:81:6f:7a:b6:59:5d:5b:cf:f8:41:6e:36:e1:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a04d2da1df0816f7ab6595d5bcff8416e36e140/; sid:903200623; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"79:d8:55:04:a4:d0:4b:48:6b:d1:56:d4:9c:f7:12:d3:30:0c:0c:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79d85504a4d04b486bd156d49cf712d3300c0c68/; sid:903200624; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4b:8b:11:e5:bc:fd:80:5c:f0:7e:64:f8:23:de:37:ee:eb:6d:7e:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4b8b11e5bcfd805cf07e64f823de37eeeb6d7ea9/; sid:903200625; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"34:0f:be:80:0a:2e:93:73:f4:c8:6e:8d:b8:a8:88:ec:d3:0c:c3:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/340fbe800a2e9373f4c86e8db8a888ecd30cc317/; sid:903200626; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KINS C&C)"; tls_cert_fingerprint; content:"5f:66:d8:e9:11:02:fc:2e:03:d5:5f:90:bd:6f:59:8b:12:3d:0a:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f66d8e91102fc2e03d55f90bd6f598b123d0aa7/; sid:903200627; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:06:be:29:ae:63:19:0c:4e:cd:69:e7:2f:0d:fa:4d:70:37:ad:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7706be29ae63190c4ecd69e72f0dfa4d7037ad3e/; sid:903200628; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7d:bf:a2:18:ce:fe:83:6e:16:c3:9d:79:fc:56:67:0d:23:7d:9c:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7dbfa218cefe836e16c39d79fc56670d237d9c58/; sid:903200629; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"af:19:27:d2:14:0e:3d:1f:5d:a4:6a:58:b9:af:06:4b:9c:cb:4e:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af1927d2140e3d1f5da46a58b9af064b9ccb4e4b/; sid:903200630; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"71:ef:80:bd:c6:20:3b:26:e4:5f:ee:fc:c4:ed:69:69:5a:ef:0a:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/71ef80bdc6203b26e45feefcc4ed69695aef0a51/; sid:903200631; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"97:3f:cf:9e:f8:d1:bd:26:e9:81:c9:89:31:b0:1d:9f:c9:dd:d6:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/973fcf9ef8d1bd26e981c98931b01d9fc9ddd60e/; sid:903200632; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"73:3b:2e:b4:9c:5d:19:03:55:d0:cb:cd:86:cd:01:50:85:de:51:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/733b2eb49c5d190355d0cbcd86cd015085de517d/; sid:903200633; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8f:fe:38:ac:42:1c:cc:b1:7e:62:2f:0f:77:63:47:f5:7d:eb:ba:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ffe38ac421cccb17e622f0f776347f57debba3e/; sid:903200634; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"3d:f4:30:35:b3:d1:c6:65:d5:5a:33:4e:41:c5:bc:d3:a6:a5:fc:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3df43035b3d1c665d55a334e41c5bcd3a6a5fc67/; sid:903200635; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e3:43:83:49:70:df:db:63:1a:79:45:9d:95:89:85:07:61:8c:15:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e343834970dfdb631a79459d95898507618c1524/; sid:903200636; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"16:9f:ca:fd:6f:04:e3:f0:17:94:83:e1:02:81:bc:fb:bb:ed:f7:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/169fcafd6f04e3f0179483e10281bcfbbbedf773/; sid:903200637; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"76:f4:7d:39:9e:a1:b6:28:a9:58:7a:2f:6d:41:28:72:30:4d:40:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/76f47d399ea1b628a9587a2f6d412872304d40bd/; sid:903200638; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"e1:bc:f4:7e:9a:e4:07:0c:d8:70:64:77:72:24:83:f0:cb:ee:60:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1bcf47e9ae4070cd8706477722483f0cbee60ca/; sid:903200639; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e1:c8:49:9d:c6:82:9e:b9:a2:76:f3:8a:0b:3a:f5:b7:78:7b:ef:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1c8499dc6829eb9a276f38a0b3af5b7787bef1b/; sid:903200640; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"43:28:58:02:5a:19:d6:a9:bc:b4:7e:c3:72:c9:10:5b:f3:46:6f:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/432858025a19d6a9bcb47ec372c9105bf3466f31/; sid:903200641; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d0:1a:12:db:ff:ef:c6:c9:4a:3b:33:64:ab:1a:ee:9a:b1:d9:b5:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d01a12dbffefc6c94a3b3364ab1aee9ab1d9b598/; sid:903200642; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"da:15:e7:3d:14:a6:e4:ef:12:2c:62:84:52:a9:7c:0b:14:08:f5:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da15e73d14a6e4ef122c628452a97c0b1408f518/; sid:903200643; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"0b:8b:47:b4:b2:94:47:98:5d:42:5d:90:a6:90:26:2a:b7:33:fe:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b8b47b4b29447985d425d90a690262ab733fe94/; sid:903200644; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Rovnix C&C)"; tls_cert_fingerprint; content:"d9:39:15:54:00:49:40:51:d7:85:fb:ea:e3:39:33:f6:4a:2d:6c:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d939155400494051d785fbeae33933f64a2d6cce/; sid:903200645; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"38:f4:fd:16:4c:c4:38:50:8c:42:4f:2e:44:d9:0f:69:95:da:df:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38f4fd164cc438508c424f2e44d90f6995dadf9e/; sid:903200646; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"85:9e:91:18:b8:7e:44:2e:e3:49:76:0f:17:77:b9:65:6f:57:2a:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/859e9118b87e442ee349760f1777b9656f572ad1/; sid:903200647; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"95:26:51:83:f3:0a:41:1a:17:98:d9:34:4a:07:7a:c5:e9:59:e1:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95265183f30a411a1798d9344a077ac5e959e1fa/; sid:903200648; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"52:78:31:ab:f9:ec:62:b0:8c:75:9c:9c:14:6f:e9:c3:8b:8c:69:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/527831abf9ec62b08c759c9c146fe9c38b8c694a/; sid:903200649; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5c:25:f5:dc:34:c1:4e:aa:54:44:61:86:43:62:26:ba:fa:24:c9:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c25f5dc34c14eaa54446186436226bafa24c96a/; sid:903200650; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"59:99:6a:91:fc:cc:36:65:50:7b:53:e0:38:17:bf:b1:92:2b:31:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59996a91fccc3665507b53e03817bfb1922b31a5/; sid:903200651; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c1:f8:7b:ec:7c:d3:6d:b0:28:55:52:7a:8b:47:55:54:25:c1:50:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1f87bec7cd36db02855527a8b47555425c1504e/; sid:903200652; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"02:47:cd:18:09:77:61:be:58:6d:21:6f:6f:22:96:63:93:28:4a:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0247cd18097761be586d216f6f22966393284a52/; sid:903200653; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a1:a5:d7:c2:34:0e:e8:9d:cf:9d:a7:ed:68:f2:51:1e:5f:f0:ea:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a1a5d7c2340ee89dcf9da7ed68f2511e5ff0ea6e/; sid:903200654; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"21:96:77:36:36:9c:f9:3d:ea:a3:f1:8c:c4:de:66:47:e5:7a:09:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/21967736369cf93deaa3f18cc4de6647e57a0931/; sid:903200655; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c1:38:3e:78:1e:a1:83:07:5a:e9:77:f6:fd:b8:4c:af:7e:20:22:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1383e781ea183075ae977f6fdb84caf7e20226e/; sid:903200656; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"ab:54:05:30:f1:e1:fb:0c:e9:8c:69:80:05:3b:9d:09:10:0a:b6:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab540530f1e1fb0ce98c6980053b9d09100ab6e5/; sid:903200657; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"1b:00:2f:4e:a7:5a:30:d5:a6:30:f0:80:a3:25:ed:ff:70:f8:0e:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b002f4ea75a30d5a630f080a325edff70f80e69/; sid:903200658; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"3b:8d:8d:86:99:39:91:04:37:d9:e2:60:28:33:b6:ff:9d:92:c5:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b8d8d869939910437d9e2602833b6ff9d92c5df/; sid:903200659; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5d:85:36:de:1f:50:74:1b:84:08:a7:20:14:02:89:ec:38:be:b8:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d8536de1f50741b8408a720140289ec38beb8c2/; sid:903200660; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"97:4c:47:4b:1a:1e:76:bd:58:e8:94:e5:a2:db:8b:c5:76:41:2d:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/974c474b1a1e76bd58e894e5a2db8bc576412dd6/; sid:903200661; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d1:45:d8:27:5b:ae:96:2f:46:73:fe:7f:62:b0:59:45:79:d1:b9:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d145d8275bae962f4673fe7f62b0594579d1b95e/; sid:903200662; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d3:e8:93:a4:4a:04:46:e5:59:16:8f:de:5b:33:1e:c4:4d:64:94:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3e893a44a0446e559168fde5b331ec44d64944c/; sid:903200663; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"46:3e:04:4c:0a:df:20:fc:82:67:fe:c7:f6:48:d8:a6:19:5b:71:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/463e044c0adf20fc8267fec7f648d8a6195b7187/; sid:903200664; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3b:a7:14:51:9b:3e:f3:dd:3c:75:f1:cb:e9:91:9e:15:06:4f:60:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ba714519b3ef3dd3c75f1cbe9919e15064f606d/; sid:903200665; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"35:fa:1d:3f:1b:03:24:07:47:2a:76:39:65:4b:33:80:1c:12:4c:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35fa1d3f1b032407472a7639654b33801c124cea/; sid:903200666; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fc:c4:1f:77:ed:1a:ef:50:dc:f2:79:2d:58:05:62:bf:df:8a:39:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fcc41f77ed1aef50dcf2792d580562bfdf8a3955/; sid:903200667; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"64:ae:bd:ab:0f:ca:ec:d9:67:1e:e8:36:ab:f0:9d:52:28:dd:36:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64aebdab0fcaecd9671ee836abf09d5228dd368b/; sid:903200668; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6c:f7:05:57:03:02:2f:18:dc:33:28:19:23:14:be:94:da:23:7b:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cf7055703022f18dc3328192314be94da237b04/; sid:903200669; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b8:75:e2:57:ca:8c:cf:1a:aa:e2:53:6d:a4:e5:39:b4:7e:f8:48:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b875e257ca8ccf1aaae2536da4e539b47ef84835/; sid:903200670; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ff:42:e4:58:74:2b:ae:07:bf:f6:96:c1:7f:39:66:28:e1:19:28:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff42e458742bae07bff696c17f396628e1192821/; sid:903200671; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1b:cf:27:3e:38:e5:5a:8d:42:a4:f1:1a:e0:1e:27:58:a8:93:4a:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1bcf273e38e55a8d42a4f11ae01e2758a8934a17/; sid:903200672; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:6c:c2:cd:23:5a:23:1b:f3:17:e4:3a:bd:3e:be:ef:87:0e:ea:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d6cc2cd235a231bf317e43abd3ebeef870eea83/; sid:903200673; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f7:76:07:7e:93:7d:b2:80:ce:77:ea:cd:06:12:1c:73:68:da:99:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f776077e937db280ce77eacd06121c7368da99d5/; sid:903200674; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:01:c2:65:00:f6:3a:bc:d4:9e:b5:57:3c:2a:ea:1c:da:ed:ff:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c101c26500f63abcd49eb5573c2aea1cdaedff8e/; sid:903200675; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Teslacrypt C&C)"; tls_cert_fingerprint; content:"79:84:5a:4e:02:fa:72:42:32:12:0e:67:c0:48:00:0a:9d:c7:42:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79845a4e02fa724232120e67c048000a9dc74239/; sid:903200676; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"84:8c:e4:35:30:97:2c:4a:ec:6c:57:d2:f0:0e:fe:b7:98:5b:9e:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/848ce43530972c4aec6c57d2f00efeb7985b9eed/; sid:903200677; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:a6:37:c1:99:7f:86:f2:c3:ed:fd:cc:f1:2f:d8:1e:f4:54:09:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32a637c1997f86f2c3edfdccf12fd81ef4540970/; sid:903200678; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"95:67:a4:91:c3:a3:80:5c:48:4b:46:d6:a8:26:ea:a2:54:c3:bc:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9567a491c3a3805c484b46d6a826eaa254c3bc93/; sid:903200679; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"3f:3d:22:65:11:27:5a:3c:f9:b5:f1:7e:a5:83:22:03:0d:f7:92:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3f3d226511275a3cf9b5f17ea58322030df79298/; sid:903200680; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f0:88:25:ae:fa:a2:96:a6:41:7e:87:ae:67:cf:04:af:75:58:e3:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f08825aefaa296a6417e87ae67cf04af7558e3e1/; sid:903200681; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2f:82:8e:bb:21:a6:2d:88:88:7b:c0:97:8d:b7:3d:00:7d:cd:36:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2f828ebb21a62d88887bc0978db73d007dcd36b7/; sid:903200682; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2c:c3:ef:4a:c0:86:9d:a8:55:46:e2:f4:87:ab:72:2f:91:d8:3c:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2cc3ef4ac0869da85546e2f487ab722f91d83c0f/; sid:903200683; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"34:4c:90:fd:31:f7:11:da:b2:e4:27:0b:06:17:18:1c:ec:50:91:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/344c90fd31f711dab2e4270b0617181cec5091c1/; sid:903200684; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1d:9d:45:2d:95:88:6d:ef:36:65:9e:04:01:fd:66:f2:3f:72:77:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d9d452d95886def36659e0401fd66f23f727754/; sid:903200685; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"a4:e7:53:68:68:63:9b:8c:1d:94:0f:72:a7:40:0c:23:33:24:07:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a4e7536868639b8c1d940f72a7400c2333240704/; sid:903200686; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0b:4a:26:6e:b2:13:b6:41:76:92:00:72:9e:c0:6b:fc:1f:da:02:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b4a266eb213b641769200729ec06bfc1fda028b/; sid:903200687; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:5d:e0:8d:65:ed:06:29:fc:7b:95:bf:fa:22:c2:c6:27:92:d3:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef5de08d65ed0629fc7b95bffa22c2c62792d3dd/; sid:903200688; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a9:ed:d0:d9:7c:fb:f1:cd:dd:6b:10:19:38:14:01:40:b8:b3:6b:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9edd0d97cfbf1cddd6b101938140140b8b36be3/; sid:903200689; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"73:33:36:c3:82:6c:84:c4:d0:ba:3a:3d:43:12:78:d3:ba:50:63:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/733336c3826c84c4d0ba3a3d431278d3ba5063dc/; sid:903200690; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"12:06:c8:14:7f:d7:2b:7e:41:b6:f7:e6:3b:f0:67:c1:55:cf:ae:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1206c8147fd72b7e41b6f7e63bf067c155cfae0a/; sid:903200691; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:4c:80:04:ed:1e:f9:a5:02:c9:df:c7:25:24:15:7c:7b:6b:13:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/314c8004ed1ef9a502c9dfc72524157c7b6b134c/; sid:903200692; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:48:0e:2e:f7:0a:a9:1d:f7:3c:72:26:d4:12:95:7b:5d:e4:ba:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85480e2ef70aa91df73c7226d412957b5de4ba67/; sid:903200693; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"55:29:1c:87:ab:70:08:b4:a2:31:0e:22:35:74:df:89:28:c7:5d:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55291c87ab7008b4a2310e223574df8928c75db2/; sid:903200694; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:2b:99:cb:b7:c9:3b:d1:b1:f9:7c:aa:be:60:28:19:78:e2:f1:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/062b99cbb7c93bd1b1f97caabe60281978e2f1e0/; sid:903200695; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"03:a3:b4:cb:7b:4e:d1:ed:a7:b4:cd:46:35:03:83:e9:e3:0a:22:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/03a3b4cb7b4ed1eda7b4cd46350383e9e30a2260/; sid:903200696; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"aa:1b:c5:42:36:5b:ca:c7:4c:3e:0f:8b:19:5c:e1:6f:96:33:02:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa1bc542365bcac74c3e0f8b195ce16f963302a3/; sid:903200697; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"7f:f2:f1:35:b2:8a:a1:da:69:35:56:de:b5:3c:d8:ab:cd:65:2d:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7ff2f135b28aa1da693556deb53cd8abcd652d9e/; sid:903200698; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8f:49:54:02:10:fa:db:c6:d6:73:65:c1:1c:53:90:31:79:28:af:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f49540210fadbc6d67365c11c5390317928afd7/; sid:903200699; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d1:0c:ad:ba:6a:a8:47:ff:c7:09:84:6f:17:78:c7:9c:42:34:15:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d10cadba6aa847ffc709846f1778c79c42341558/; sid:903200700; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"02:fc:ce:97:c6:a9:c0:15:4e:06:9c:1c:5f:78:0e:af:e5:3d:67:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02fcce97c6a9c0154e069c1c5f780eafe53d6766/; sid:903200701; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"0c:5c:0b:11:42:67:59:09:39:59:2a:6d:4a:81:9d:89:17:09:7f:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c5c0b114267590939592a6d4a819d8917097f73/; sid:903200702; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bc:53:2d:05:59:00:6d:89:89:d6:67:d5:42:1a:3b:7a:2b:d9:13:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc532d0559006d8989d667d5421a3b7a2bd913fb/; sid:903200703; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"57:91:fe:fc:48:08:c7:3d:fa:29:7d:6d:a6:78:c0:c7:3d:cb:f7:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5791fefc4808c73dfa297d6da678c0c73dcbf70c/; sid:903200704; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c3:de:7a:f6:2d:b8:a1:54:73:eb:12:eb:5f:4f:71:61:00:05:04:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3de7af62db8a15473eb12eb5f4f716100050469/; sid:903200705; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b0:0e:b8:2e:af:df:6f:03:51:c7:31:d6:1e:d7:79:9d:3b:a4:e5:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b00eb82eafdf6f0351c731d61ed7799d3ba4e541/; sid:903200706; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"87:31:48:80:0a:8b:b1:c0:9c:41:71:34:c2:9e:aa:c6:32:5d:ec:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/873148800a8bb1c09c417134c29eaac6325decc0/; sid:903200707; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:5b:62:5b:66:a2:1a:07:32:05:58:cd:ce:87:d6:fc:d1:55:c6:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a65b625b66a21a07320558cdce87d6fcd155c6ab/; sid:903200708; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fb:67:9d:30:4a:02:bf:0b:f5:04:0a:a7:03:c9:1b:72:38:cd:eb:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb679d304a02bf0bf5040aa703c91b7238cdebb6/; sid:903200709; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"08:b1:ab:fd:16:e6:b5:69:c2:91:2f:7d:38:27:52:a1:4b:63:82:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08b1abfd16e6b569c2912f7d382752a14b638298/; sid:903200710; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"30:61:69:20:ac:76:99:7a:7e:a0:80:45:a7:d3:3b:8f:d9:cb:bd:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30616920ac76997a7ea08045a7d33b8fd9cbbd83/; sid:903200711; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:e1:b3:2b:a4:18:53:30:a3:05:82:b9:8d:a9:63:94:45:74:ee:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77e1b32ba4185330a30582b98da963944574ee54/; sid:903200712; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4b:fb:d8:d9:a5:71:9c:9b:1f:19:41:5e:e9:40:e6:f2:b4:e8:51:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4bfbd8d9a5719c9b1f19415ee940e6f2b4e851c0/; sid:903200713; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (URLzone C&C)"; tls_cert_fingerprint; content:"e3:bc:92:32:57:29:e8:df:8a:09:7b:5b:9d:ea:f8:5f:d1:48:4a:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e3bc92325729e8df8a097b5b9deaf85fd1484a29/; sid:903200714; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"eb:5a:22:da:95:2b:36:78:2d:45:16:4e:66:e9:de:9c:f3:d7:92:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb5a22da952b36782d45164e66e9de9cf3d79226/; sid:903200715; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"59:52:7a:7c:3b:12:31:c7:29:88:58:5a:57:77:f5:09:76:96:85:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59527a7c3b1231c72988585a5777f50976968561/; sid:903200716; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5f:bd:d8:2f:54:d3:8f:98:eb:94:a6:9c:14:c8:2f:93:f7:9c:ff:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fbdd82f54d38f98eb94a69c14c82f93f79cffb6/; sid:903200717; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cb:18:cf:0f:6c:64:19:a0:19:9c:ec:92:94:79:ae:34:d5:42:3f:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb18cf0f6c6419a0199cec929479ae34d5423f6d/; sid:903200718; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"cc:1c:9f:c8:42:01:24:6c:71:50:de:88:f6:5a:0d:6f:14:cc:2a:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cc1c9fc84201246c7150de88f65a0d6f14cc2a78/; sid:903200719; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fa:69:20:25:3a:93:83:bd:b0:26:dc:29:3a:84:6a:ad:6e:75:6a:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa6920253a9383bdb026dc293a846aad6e756a23/; sid:903200720; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e7:11:b0:02:bb:dc:bc:2a:e5:18:e5:48:db:fb:0d:20:a0:af:b0:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e711b002bbdcbc2ae518e548dbfb0d20a0afb0a6/; sid:903200721; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"ca:99:d2:b2:f9:bf:4d:45:08:3f:f8:78:3f:55:89:32:47:55:10:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca99d2b2f9bf4d45083ff8783f5589324755104f/; sid:903200722; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"8d:a5:60:2a:a7:f9:48:43:2f:7a:ff:15:41:b0:02:bf:f4:ae:d4:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8da5602aa7f948432f7aff1541b002bff4aed46d/; sid:903200723; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"94:07:c6:f0:2a:1b:99:58:fc:ce:89:2d:60:a6:6a:2b:10:ce:42:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9407c6f02a1b9958fcce892d60a66a2b10ce42cc/; sid:903200724; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"40:9f:65:d3:6a:d6:7c:47:e2:0e:3d:b1:20:50:f8:f6:43:a5:19:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/409f65d36ad67c47e20e3db12050f8f643a519f7/; sid:903200725; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1c:99:53:97:6e:24:e6:b7:59:12:53:64:74:41:98:8a:71:b3:ae:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c9953976e24e6b7591253647441988a71b3aea9/; sid:903200726; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b1:af:ea:24:33:14:7d:38:04:3d:7b:05:d4:cb:6c:4a:29:a7:79:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1afea2433147d38043d7b05d4cb6c4a29a779f1/; sid:903200727; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5c:9e:f8:d3:87:ed:9b:39:93:f0:71:ab:07:49:fd:3b:a5:ea:b6:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c9ef8d387ed9b3993f071ab0749fd3ba5eab6ae/; sid:903200728; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"f2:59:78:bd:8f:6c:89:7b:ea:29:bc:be:b5:da:a0:df:8b:b5:7f:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f25978bd8f6c897bea29bcbeb5daa0df8bb57f36/; sid:903200729; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"68:b1:5d:44:c8:2a:c5:2f:a0:08:af:20:23:da:1a:74:d5:5d:b8:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68b15d44c82ac52fa008af2023da1a74d55db8d6/; sid:903200730; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d4:92:51:a9:a7:86:23:c0:f6:0b:3a:e5:ec:b8:22:5a:ec:9d:c6:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d49251a9a78623c0f60b3ae5ecb8225aec9dc6bf/; sid:903200731; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8f:72:08:2f:fe:a6:86:40:e7:7d:18:5a:d0:30:1e:8f:98:c0:4d:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f72082ffea68640e77d185ad0301e8f98c04d52/; sid:903200732; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8e:09:af:5a:08:0e:ac:fa:45:1f:3b:1a:d3:cd:e0:c5:01:1b:5a:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8e09af5a080eacfa451f3b1ad3cde0c5011b5a6e/; sid:903200733; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6f:47:c3:1a:7a:b7:b0:d3:23:4c:d6:17:d5:f4:af:0b:01:6d:cf:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f47c31a7ab7b0d3234cd617d5f4af0b016dcfa9/; sid:903200734; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:0a:2d:b7:00:2e:9d:0e:66:c8:2f:d7:39:55:a1:d4:70:26:3b:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/320a2db7002e9d0e66c82fd73955a1d470263b7e/; sid:903200735; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8f:39:ba:6a:c8:aa:e9:59:c2:6d:ec:e6:5d:f1:78:dc:69:ea:1a:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f39ba6ac8aae959c26dece65df178dc69ea1a12/; sid:903200736; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:51:1b:00:01:ae:c7:af:20:b6:1a:ff:f7:ff:93:b3:0f:db:1d:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef511b0001aec7af20b61afff7ff93b30fdb1d66/; sid:903200737; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:ae:db:db:8b:d0:20:44:0c:93:6c:b2:5a:b7:75:fb:0d:42:f0:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15aedbdb8bd020440c936cb25ab775fb0d42f098/; sid:903200738; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d7:74:43:01:5e:be:92:c6:9f:f4:59:e6:20:f8:54:46:24:10:20:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d77443015ebe92c69ff459e620f85446241020e0/; sid:903200739; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b5:97:be:b8:d4:cf:6e:05:6c:f6:b0:d9:43:39:8e:ac:db:dd:cc:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b597beb8d4cf6e056cf6b0d943398eacdbddcc0a/; sid:903200740; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7d:ea:4f:93:56:c8:47:0f:f9:5c:c8:50:af:22:09:04:74:f9:de:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7dea4f9356c8470ff95cc850af22090474f9deeb/; sid:903200741; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e4:af:ee:41:db:f6:e5:c5:e4:a2:9f:ed:9c:ed:d9:88:c8:d7:09:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e4afee41dbf6e5c5e4a29fed9cedd988c8d709f7/; sid:903200742; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"67:32:f7:4d:e6:a0:4c:d9:75:17:6f:3b:87:c8:a3:b2:a6:5e:0b:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6732f74de6a04cd975176f3b87c8a3b2a65e0b41/; sid:903200743; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"55:ff:21:47:79:42:a2:ad:af:bc:0a:dc:d4:ab:58:57:b2:4a:71:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55ff21477942a2adafbc0adcd4ab5857b24a71d5/; sid:903200744; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fd:2b:0f:98:85:cb:30:25:f2:c3:54:40:d6:87:f9:2d:e0:82:e4:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd2b0f9885cb3025f2c35440d687f92de082e40a/; sid:903200745; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0a:a0:c9:0b:65:24:19:2b:0b:07:8e:92:79:b3:ca:1a:0e:1e:76:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0aa0c90b6524192b0b078e9279b3ca1a0e1e7625/; sid:903200746; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"80:fb:1c:50:e8:08:81:ca:4e:07:b1:2b:19:11:35:ef:a1:0d:37:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80fb1c50e80881ca4e07b12b191135efa10d37be/; sid:903200747; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"92:a0:b1:da:aa:7f:cd:4e:e0:75:93:97:d8:c3:8c:35:03:c6:ce:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92a0b1daaa7fcd4ee0759397d8c38c3503c6ce01/; sid:903200748; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"19:5f:73:4d:14:4f:fb:90:8f:92:cb:ef:3e:ed:5c:65:87:08:46:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/195f734d144ffb908f92cbef3eed5c658708468c/; sid:903200749; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"62:7b:8c:ce:95:73:b2:09:21:83:ff:84:72:fe:e0:68:a2:e8:46:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/627b8cce9573b2092183ff8472fee068a2e84627/; sid:903200750; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:06:3d:83:47:0b:70:a1:77:0b:9c:a5:7f:b7:5b:bc:1c:01:aa:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9063d83470b70a1770b9ca57fb75bbc1c01aa15/; sid:903200751; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"0e:63:75:95:75:63:3c:b2:62:6c:fe:23:f0:ac:5f:67:50:6c:ff:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e63759575633cb2626cfe23f0ac5f67506cff1b/; sid:903200752; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f7:99:e4:82:21:b5:cd:b6:fb:ca:a4:6f:19:21:a4:5f:d0:c1:5b:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f799e48221b5cdb6fbcaa46f1921a45fd0c15b84/; sid:903200753; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1e:0a:26:9d:ac:50:5f:8a:c2:fc:13:c2:fb:57:d4:3b:e5:2b:17:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e0a269dac505f8ac2fc13c2fb57d43be52b1728/; sid:903200754; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ProxyChanger C&C)"; tls_cert_fingerprint; content:"63:ef:da:45:06:df:0e:6e:04:78:fb:9d:ad:44:9e:c4:75:60:c6:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63efda4506df0e6e0478fb9dad449ec47560c630/; sid:903200755; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ProxyChanger C&C)"; tls_cert_fingerprint; content:"0d:bf:c8:d8:26:5b:86:04:f7:23:0d:58:90:cf:99:2d:74:a4:5d:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dbfc8d8265b8604f7230d5890cf992d74a45d3a/; sid:903200756; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5b:6e:13:1e:f5:77:4f:dd:27:f7:9e:cf:cc:9a:fd:7b:ff:7c:8a:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b6e131ef5774fdd27f79ecfcc9afd7bff7c8a71/; sid:903200757; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"56:56:4c:88:ff:f3:39:a7:73:09:d3:9f:97:fc:a5:61:8c:a8:5e:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/56564c88fff339a77309d39f97fca5618ca85ecb/; sid:903200758; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (VMZeuS C&C)"; tls_cert_fingerprint; content:"2c:5b:14:04:83:ca:cc:2f:05:39:eb:86:65:74:ee:f1:18:2b:fe:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c5b140483cacc2f0539eb866574eef1182bfe13/; sid:903200759; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"be:1e:0d:97:60:42:91:97:25:59:4f:46:e7:ba:91:45:a7:ab:46:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be1e0d976042919725594f46e7ba9145a7ab46f2/; sid:903200760; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"70:82:20:8f:27:9b:69:5c:53:e3:c5:b5:8b:07:44:aa:c7:45:85:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7082208f279b695c53e3c5b58b0744aac7458531/; sid:903200761; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e4:39:e4:7d:dd:f9:bc:6b:db:61:78:3e:f0:65:9e:32:e4:bd:a8:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e439e47dddf9bc6bdb61783ef0659e32e4bda86d/; sid:903200762; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"db:9f:2f:ad:df:00:61:a6:d8:c6:3a:13:8c:2a:af:14:e9:75:b2:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db9f2faddf0061a6d8c63a138c2aaf14e975b21d/; sid:903200763; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"79:b1:d8:16:6a:5c:c7:fa:8d:b6:96:b6:a3:b8:da:53:a8:4c:b0:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79b1d8166a5cc7fa8db696b6a3b8da53a84cb066/; sid:903200764; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"bc:d9:5c:b6:68:a7:d0:f1:cb:d6:9c:08:21:ce:af:bf:5c:c9:35:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bcd95cb668a7d0f1cbd69c0821ceafbf5cc9354e/; sid:903200765; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"d6:94:1b:24:a3:0d:f5:c4:8f:e9:62:43:88:41:20:aa:3c:16:41:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d6941b24a30df5c48fe96243884120aa3c1641c4/; sid:903200766; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"07:92:49:32:6f:a6:fe:9f:d6:06:6b:7b:00:b5:1e:a6:58:cc:c4:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/079249326fa6fe9fd6066b7b00b51ea658ccc453/; sid:903200767; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a8:38:ff:d6:95:03:39:08:b3:a3:f0:ba:d7:65:3c:38:ed:ce:eb:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a838ffd695033908b3a3f0bad7653c38edceebb4/; sid:903200768; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"35:7d:83:ca:c3:a1:16:7d:83:87:d4:e7:3d:31:96:fe:84:5e:ac:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/357d83cac3a1167d8387d4e73d3196fe845eacdb/; sid:903200769; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"60:9d:68:66:ef:00:1b:94:11:fe:9a:95:e4:72:95:7f:ef:28:2e:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/609d6866ef001b9411fe9a95e472957fef282e38/; sid:903200770; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"f0:79:2a:65:9b:32:fc:57:0a:ad:fc:cc:db:8d:93:09:12:cc:f8:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0792a659b32fc570aadfcccdb8d930912ccf852/; sid:903200771; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"14:13:3d:53:ce:26:bf:94:c0:39:7c:41:0d:af:b6:75:c3:ab:62:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14133d53ce26bf94c0397c410dafb675c3ab62d6/; sid:903200772; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"36:6f:27:27:c6:a2:86:a8:78:19:a7:64:e4:ed:bf:bc:5a:b4:bc:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/366f2727c6a286a87819a764e4edbfbc5ab4bca1/; sid:903200773; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"5c:8e:ef:8f:30:af:ae:b9:27:52:21:7c:3e:d1:82:0f:93:e8:05:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c8eef8f30afaeb92752217c3ed1820f93e80551/; sid:903200774; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"26:fc:57:25:d6:6c:4b:a7:67:ad:07:65:bb:b9:49:66:67:2a:13:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26fc5725d66c4ba767ad0765bbb94966672a13ee/; sid:903200775; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"c4:68:c4:fc:30:77:d3:c5:12:ed:e9:04:0b:c6:0a:b2:ad:b3:18:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c468c4fc3077d3c512ede9040bc60ab2adb318d8/; sid:903200776; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:86:10:b6:e4:89:7a:29:a1:82:82:46:61:94:be:ef:68:27:83:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a38610b6e4897a29a18282466194beef68278337/; sid:903200777; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"02:e6:87:c4:4d:a4:46:7f:c7:76:39:ab:ba:9b:a9:1e:0a:c1:0d:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02e687c44da4467fc77639abba9ba91e0ac10d65/; sid:903200778; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"9a:7d:ab:d7:d2:e4:62:02:d3:37:02:e9:a9:0b:aa:02:bb:fe:89:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a7dabd7d2e46202d33702e9a90baa02bbfe8940/; sid:903200779; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Downloder-Bot C&C)"; tls_cert_fingerprint; content:"84:c4:d0:12:ae:29:02:4e:d3:7d:46:80:fa:e2:9e:16:63:b3:ab:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84c4d012ae29024ed37d4680fae29e1663b3abcf/; sid:903200780; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"9a:d9:da:05:9c:a7:99:44:fd:d0:29:00:e1:83:55:eb:e4:dd:3a:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ad9da059ca79944fdd02900e18355ebe4dd3acc/; sid:903200781; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d9:32:fe:11:f6:e2:0d:5c:59:e4:5c:ea:25:47:d8:a5:59:0b:26:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d932fe11f6e20d5c59e45cea2547d8a5590b269a/; sid:903200782; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"22:32:82:38:ec:37:48:21:38:3f:0e:3e:59:cf:48:57:c2:91:4e:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22328238ec374821383f0e3e59cf4857c2914e36/; sid:903200783; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b8:40:3c:a5:31:a4:d6:23:94:d4:32:76:3c:57:6c:e6:78:f9:1d:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b8403ca531a4d62394d432763c576ce678f91d17/; sid:903200784; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:74:a4:18:a7:60:d4:30:41:bf:d9:50:2b:4b:6a:2c:e8:83:5b:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e974a418a760d43041bfd9502b4b6a2ce8835b82/; sid:903200785; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"af:f3:4f:fd:f3:57:60:c6:69:97:02:2c:82:a0:a3:f5:23:ab:80:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aff34ffdf35760c66997022c82a0a3f523ab80c4/; sid:903200786; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"2b:83:fa:06:ef:38:ad:cf:63:a3:c8:9f:f0:d5:95:37:58:47:ab:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b83fa06ef38adcf63a3c89ff0d595375847ab4f/; sid:903200787; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"fc:10:4d:36:d3:dd:a9:8c:c0:51:07:43:79:cf:48:32:ac:04:89:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc104d36d3dda98cc051074379cf4832ac048998/; sid:903200788; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"0e:66:f3:d4:15:a6:e8:3a:25:ce:59:5e:40:9a:8c:8b:e4:e8:7a:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e66f3d415a6e83a25ce595e409a8c8be4e87af8/; sid:903200789; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"83:fd:75:27:33:df:42:35:32:ae:30:41:b8:25:d0:b7:b9:23:ca:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/83fd752733df423532ae3041b825d0b7b923cad4/; sid:903200790; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"38:47:44:47:e1:8b:e8:bc:f2:52:0b:89:37:ca:a6:1a:bf:3c:cd:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38474447e18be8bcf2520b8937caa61abf3ccddb/; sid:903200791; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"39:da:9c:24:02:f9:da:3f:5c:44:61:6e:3c:ea:43:9c:f1:85:ff:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39da9c2402f9da3f5c44616e3cea439cf185ff71/; sid:903200792; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"bd:a7:93:90:ac:da:19:9c:d4:62:ad:56:94:1b:32:0d:30:fc:8e:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bda79390acda199cd462ad56941b320d30fc8e55/; sid:903200793; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"02:f5:e6:37:3b:0d:c0:af:d8:b7:e2:c9:cb:75:09:bc:b9:1c:76:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02f5e6373b0dc0afd8b7e2c9cb7509bcb91c7622/; sid:903200794; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"90:10:06:fb:67:aa:be:a7:c7:40:4e:78:46:da:57:80:b7:71:aa:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/901006fb67aabea7c7404e7846da5780b771aaba/; sid:903200795; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a0:92:97:9f:dc:86:be:59:f6:0f:b6:9c:6e:35:39:f3:6c:ba:65:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a092979fdc86be59f60fb69c6e3539f36cba6599/; sid:903200796; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"eb:92:99:08:c5:6e:fb:f6:d9:ef:1a:60:6f:15:af:f7:28:cf:cc:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb929908c56efbf6d9ef1a606f15aff728cfcc77/; sid:903200797; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"80:cb:d6:82:51:61:3e:2a:b1:d9:8c:f7:c1:fb:e0:59:a4:a7:be:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80cbd68251613e2ab1d98cf7c1fbe059a4a7be46/; sid:903200798; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"80:01:3e:03:9d:9b:45:e0:f0:5a:aa:f9:41:d5:db:a9:f7:f5:b4:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80013e039d9b45e0f05aaaf941d5dba9f7f5b452/; sid:903200799; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:db:ac:5a:c9:3b:59:d6:9f:fe:b0:ea:eb:21:10:a5:0b:c8:6b:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31dbac5ac93b59d69ffeb0eaeb2110a50bc86beb/; sid:903200800; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"09:c1:2a:d9:ac:2d:e7:d3:01:4a:6b:08:dd:eb:77:b4:23:82:1b:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09c12ad9ac2de7d3014a6b08ddeb77b423821b27/; sid:903200801; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"cb:76:1e:89:0e:74:94:af:d0:51:f9:76:1e:7a:cf:4b:55:39:69:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb761e890e7494afd051f9761e7acf4b553969b3/; sid:903200802; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9c:53:81:e6:68:9f:0a:cc:f3:78:c0:10:73:6a:e6:d2:1f:31:1d:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c5381e6689f0accf378c010736ae6d21f311d57/; sid:903200803; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b6:c0:46:95:b7:13:e3:f6:f2:42:8d:30:3d:c7:7b:d0:88:ca:ae:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6c04695b713e3f6f2428d303dc77bd088caaeb3/; sid:903200804; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ba:7f:b5:50:47:59:55:74:e5:e9:d8:e7:6f:d6:81:28:4d:b7:a5:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba7fb55047595574e5e9d8e76fd681284db7a506/; sid:903200805; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d6:5f:32:e7:a6:f1:c3:b3:9f:dc:d5:ea:42:60:a4:fc:7e:d9:9a:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d65f32e7a6f1c3b39fdcd5ea4260a4fc7ed99ab4/; sid:903200806; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"f3:3e:94:d1:43:f2:20:76:d2:03:38:2c:01:1d:12:9d:93:a0:19:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f33e94d143f22076d203382c011d129d93a01968/; sid:903200807; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"bd:e7:37:9c:4f:45:97:37:7e:b0:92:00:ea:45:20:b2:e4:30:57:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bde7379c4f4597377eb09200ea4520b2e4305704/; sid:903200808; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"9c:fa:5b:74:92:8b:9e:a4:47:b9:38:15:3e:db:3e:52:16:32:b1:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9cfa5b74928b9ea447b938153edb3e521632b17f/; sid:903200809; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"20:59:70:cf:e0:65:bb:c3:d0:31:de:d9:f7:29:1c:0f:5e:16:9f:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/205970cfe065bbc3d031ded9f7291c0f5e169f94/; sid:903200810; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Retefe C&C)"; tls_cert_fingerprint; content:"a6:35:d2:21:29:e6:eb:47:ee:2e:e9:f1:84:24:b6:e7:ae:b6:ae:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a635d22129e6eb47ee2ee9f18424b6e7aeb6ae26/; sid:903200811; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"89:d6:80:a4:96:5f:d6:5a:ec:35:4e:e7:6a:8c:cb:cd:37:76:29:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89d680a4965fd65aec354ee76a8ccbcd377629ed/; sid:903200812; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"da:3f:73:1e:1f:54:cb:a1:1c:01:dd:4e:b3:c4:8e:fe:35:4c:6f:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da3f731e1f54cba11c01dd4eb3c48efe354c6ff9/; sid:903200813; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"27:8a:38:97:2a:62:a8:c2:6c:f0:17:ab:61:ae:74:74:17:a5:e6:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/278a38972a62a8c26cf017ab61ae747417a5e687/; sid:903200814; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"cf:d1:09:e4:8f:a5:46:4e:66:59:43:88:dc:81:09:2e:ee:67:1a:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfd109e48fa5464e66594388dc81092eee671a59/; sid:903200815; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"de:5e:17:c7:f2:20:ac:ba:eb:8d:be:b4:ef:5c:8b:36:c1:dd:c1:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de5e17c7f220acbaeb8dbeb4ef5c8b36c1ddc12e/; sid:903200816; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e5:bf:ef:e6:6b:52:e3:89:03:37:e5:5d:93:d9:59:53:ba:ea:8f:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e5bfefe66b52e3890337e55d93d95953baea8f10/; sid:903200817; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a5:40:1a:41:21:b0:59:30:f9:ad:a2:f9:f2:fa:ea:0f:31:98:79:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5401a4121b05930f9ada2f9f2faea0f3198793c/; sid:903200818; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d9:ef:3d:c9:64:b6:7f:5a:99:bf:cd:61:88:24:8e:2a:64:1c:2b:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9ef3dc964b67f5a99bfcd6188248e2a641c2b6c/; sid:903200819; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3e:db:18:a6:ac:f7:43:70:46:1a:fd:11:c6:44:21:ac:0f:b1:d3:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3edb18a6acf74370461afd11c64421ac0fb1d370/; sid:903200820; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"90:73:e7:1b:44:ed:8a:51:87:a6:10:12:e0:0d:40:cd:7a:93:23:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9073e71b44ed8a5187a61012e00d40cd7a932339/; sid:903200821; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"11:8c:05:5a:b8:83:7c:bf:ad:16:70:26:2d:a0:46:e6:8f:fe:fe:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/118c055ab8837cbfad1670262da046e68ffefeba/; sid:903200822; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"dd:2b:51:ae:50:c8:ba:78:f1:5e:48:39:d6:79:a1:49:d2:0f:5c:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd2b51ae50c8ba78f15e4839d679a149d20f5c5a/; sid:903200823; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ee:b5:6d:5c:76:d0:c5:45:5c:34:b4:47:e3:0d:20:0d:b6:7c:98:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eeb56d5c76d0c5455c34b447e30d200db67c982a/; sid:903200824; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"da:74:a9:7a:9f:62:e4:71:c1:2f:a3:62:b3:6e:5b:cc:66:43:cf:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da74a97a9f62e471c12fa362b36e5bcc6643cf51/; sid:903200825; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"96:a3:45:a2:3a:e8:26:bb:a3:c4:da:24:70:ac:02:b4:0c:07:8e:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/96a345a23ae826bba3c4da2470ac02b40c078ec6/; sid:903200826; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"b8:21:b9:9a:94:5a:8a:b0:5a:85:18:c4:c1:ec:2f:45:f1:ed:60:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b821b99a945a8ab05a8518c4c1ec2f45f1ed6065/; sid:903200827; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f5:cf:90:5b:05:cd:e4:a4:8c:0f:52:5f:12:3c:8b:fb:f0:8c:c3:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5cf905b05cde4a48c0f525f123c8bfbf08cc366/; sid:903200828; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"96:85:19:d8:05:c9:85:b4:57:be:0a:2a:fe:98:a0:d0:44:ef:99:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/968519d805c985b457be0a2afe98a0d044ef99c2/; sid:903200829; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e7:a1:44:37:16:f9:ad:88:eb:28:5d:c6:b6:9f:67:4f:e7:33:72:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7a1443716f9ad88eb285dc6b69f674fe733727d/; sid:903200830; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e0:18:44:c6:a6:06:3b:62:35:65:31:27:cc:54:ab:38:4e:34:ce:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e01844c6a6063b6235653127cc54ab384e34cec2/; sid:903200831; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"56:a9:aa:61:d3:66:7c:96:a3:ff:eb:94:1c:ff:22:ee:9e:a8:da:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/56a9aa61d3667c96a3ffeb941cff22ee9ea8da10/; sid:903200832; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"33:60:e0:e0:e9:4c:0f:d6:fe:d4:e0:93:93:d6:e9:bd:b6:b3:87:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3360e0e0e94c0fd6fed4e09393d6e9bdb6b38754/; sid:903200833; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e8:2c:2c:be:ec:95:4a:6d:47:bc:aa:e8:fd:23:b9:a8:09:95:e4:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e82c2cbeec954a6d47bcaae8fd23b9a80995e450/; sid:903200834; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:ea:d4:e0:18:f6:c1:fe:24:97:20:22:c1:d4:ac:55:27:50:3e:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32ead4e018f6c1fe24972022c1d4ac5527503eb4/; sid:903200835; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3e:c6:35:e0:0f:20:b5:e2:88:ff:f4:83:41:9d:e7:25:dd:42:f4:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ec635e00f20b5e288fff483419de725dd42f497/; sid:903200836; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"61:7f:1e:68:b4:fe:fe:1d:9d:a8:43:f9:0b:4d:f7:da:d7:44:d6:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/617f1e68b4fefe1d9da843f90b4df7dad744d677/; sid:903200837; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7d:da:9a:b4:38:a3:b2:d4:7b:4a:b0:7e:d5:06:07:3f:b8:81:23:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7dda9ab438a3b2d47b4ab07ed506073fb8812373/; sid:903200838; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3f:c4:67:43:e6:f6:c3:48:9e:0b:fe:ce:cc:98:cf:c6:34:cd:cb:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3fc46743e6f6c3489e0bfececc98cfc634cdcb95/; sid:903200839; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"58:c4:c5:d0:87:30:94:ae:15:53:fa:3d:7b:5a:03:3d:75:bb:de:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/58c4c5d0873094ae1553fa3d7b5a033d75bbdeb9/; sid:903200840; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a7:4d:ab:7a:38:ff:f1:12:76:72:80:63:29:12:ba:03:70:90:48:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a74dab7a38fff112767280632912ba0370904801/; sid:903200841; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b2:2e:b2:d8:68:12:47:bc:fc:51:53:bf:3a:7b:da:f5:11:e5:5a:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b22eb2d8681247bcfc5153bf3a7bdaf511e55af5/; sid:903200842; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"42:b2:af:ac:eb:4d:27:0a:19:4b:83:97:80:20:fd:47:11:e9:28:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/42b2afaceb4d270a194b83978020fd4711e928e2/; sid:903200843; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"24:09:e4:86:93:a4:ca:3a:f7:0d:d9:44:d8:77:33:27:e6:a8:51:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2409e48693a4ca3af70dd944d8773327e6a8516c/; sid:903200844; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c9:c9:63:ce:2a:f6:15:13:7c:5b:07:e1:22:96:8e:95:95:b7:7d:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9c963ce2af615137c5b07e122968e9595b77d58/; sid:903200845; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b0:77:c0:bb:cf:d6:39:7e:f7:34:1f:91:27:6f:ae:da:59:2b:7f:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b077c0bbcfd6397ef7341f91276faeda592b7ff3/; sid:903200846; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3e:e0:53:d3:8a:7f:3d:80:a4:7a:ee:37:4b:2d:49:1e:06:b6:26:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ee053d38a7f3d80a47aee374b2d491e06b62609/; sid:903200847; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7a:66:8d:51:bf:57:bd:86:b0:da:61:6e:f4:1b:e1:a1:d4:47:42:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a668d51bf57bd86b0da616ef41be1a1d44742f3/; sid:903200848; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9c:03:35:5e:c0:ec:54:85:0b:a3:26:d0:85:42:bf:f5:c2:4e:20:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c03355ec0ec54850ba326d08542bff5c24e207b/; sid:903200849; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e7:2a:db:6e:9b:c7:ef:cc:29:88:88:dc:f5:70:ef:96:37:2e:51:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e72adb6e9bc7efcc298888dcf570ef96372e510b/; sid:903200850; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"d7:e3:f2:f1:a4:5f:01:78:fa:93:29:1b:c8:e0:9c:58:14:53:5f:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7e3f2f1a45f0178fa93291bc8e09c5814535f11/; sid:903200851; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fe:89:6f:ca:5f:12:a0:f6:5a:12:e2:ae:39:58:8a:50:5c:f6:d0:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe896fca5f12a0f65a12e2ae39588a505cf6d035/; sid:903200852; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"78:3e:a8:dd:f7:49:4c:c9:36:0b:b0:35:f2:df:c4:5a:d0:60:47:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/783ea8ddf7494cc9360bb035f2dfc45ad06047ab/; sid:903200853; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"20:0d:e4:9d:4e:09:40:cc:38:c9:ea:ae:24:d5:65:2c:40:43:c5:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/200de49d4e0940cc38c9eaae24d5652c4043c5f8/; sid:903200854; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f1:0c:0a:99:cc:1e:1e:5b:8f:dc:89:13:40:97:64:a8:dc:21:35:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f10c0a99cc1e1e5b8fdc8913409764a8dc213547/; sid:903200855; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b5:df:7e:e7:88:cf:69:d8:9b:2e:dc:8a:50:44:80:63:10:c6:bc:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5df7ee788cf69d89b2edc8a5044806310c6bcd8/; sid:903200856; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"87:4d:24:58:df:13:8c:b3:4e:4a:ef:b8:9b:11:a8:e4:99:b1:ab:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/874d2458df138cb34e4aefb89b11a8e499b1abec/; sid:903200857; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fd:70:15:04:79:5d:85:f9:c6:9f:a0:89:0f:f1:e1:33:c8:07:48:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd701504795d85f9c69fa0890ff1e133c807480b/; sid:903200858; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"23:96:cf:6f:9d:9f:75:f9:14:86:1b:50:44:6f:38:10:4d:18:9f:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2396cf6f9d9f75f914861b50446f38104d189f74/; sid:903200859; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0c:1b:32:bb:67:bf:6b:3b:30:fd:d4:0c:4a:17:f6:21:4a:ef:a8:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c1b32bb67bf6b3b30fdd40c4a17f6214aefa866/; sid:903200860; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e3:8e:16:28:f6:76:8a:d5:77:1e:07:de:a4:25:65:3b:54:ba:85:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e38e1628f6768ad5771e07dea425653b54ba85d4/; sid:903200861; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"43:8d:55:ce:36:72:16:ce:4c:83:47:f5:59:bc:3b:15:3f:aa:fa:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/438d55ce367216ce4c8347f559bc3b153faafae5/; sid:903200862; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:41:d9:9a:c7:9f:2c:b5:90:e7:53:2b:13:ff:64:b2:9b:7c:80:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a341d99ac79f2cb590e7532b13ff64b29b7c80c3/; sid:903200863; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2e:4a:91:28:ea:31:dd:8c:6a:78:9f:47:75:78:47:ba:89:ca:d2:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e4a9128ea31dd8c6a789f47757847ba89cad228/; sid:903200864; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"95:c9:d9:c3:e8:e0:4f:3b:74:79:f1:58:ba:f0:ea:27:14:0f:bf:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95c9d9c3e8e04f3b7479f158baf0ea27140fbf61/; sid:903200865; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"43:20:62:f5:0c:4e:a9:79:b8:a5:ce:d1:5a:e8:6f:26:1e:d7:07:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/432062f50c4ea979b8a5ced15ae86f261ed707f4/; sid:903200866; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"6f:f3:32:35:bf:a8:59:4c:ac:5b:f6:78:da:5a:b5:79:05:bf:8d:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ff33235bfa8594cac5bf678da5ab57905bf8dc5/; sid:903200867; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0b:5e:e1:11:66:cd:7a:48:90:3d:fb:1f:4b:b5:f2:7a:65:b8:66:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b5ee11166cd7a48903dfb1f4bb5f27a65b86600/; sid:903200868; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"23:29:a3:59:e7:6f:51:d3:8d:13:06:97:a2:63:22:cc:2c:fc:9d:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2329a359e76f51d38d130697a26322cc2cfc9d17/; sid:903200869; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"be:a9:36:41:9e:54:8d:67:a7:90:30:f4:0a:d4:be:ed:00:8b:18:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bea936419e548d67a79030f40ad4beed008b1898/; sid:903200870; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"19:94:a0:b0:34:b0:2d:a7:3b:2f:e9:a1:70:f8:ce:52:71:40:c9:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1994a0b034b02da73b2fe9a170f8ce527140c9f0/; sid:903200871; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3a:ef:43:1f:8b:b8:bb:f3:8b:9f:f7:4e:7f:a2:36:95:cb:b6:76:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3aef431f8bb8bbf38b9ff74e7fa23695cbb676e6/; sid:903200872; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3e:89:48:72:30:8a:e7:01:24:5f:2c:d8:eb:b0:30:b1:39:f7:93:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e894872308ae701245f2cd8ebb030b139f79352/; sid:903200873; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6a:94:ed:cb:9f:47:ee:5a:ee:6b:28:dd:a5:98:61:20:3f:60:21:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a94edcb9f47ee5aee6b28dda59861203f602190/; sid:903200874; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"26:ee:21:af:cf:20:56:7f:80:d6:d2:f8:35:67:2c:9c:57:83:f1:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26ee21afcf20567f80d6d2f835672c9c5783f1bf/; sid:903200875; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"14:cc:ca:98:6c:4b:83:66:1d:db:f1:fb:3b:73:51:f2:16:f3:a0:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14ccca986c4b83661ddbf1fb3b7351f216f3a007/; sid:903200876; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cc:a0:28:8e:dd:2e:6e:2d:7a:15:e2:2e:31:ad:fb:ab:69:8e:ab:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cca0288edd2e6e2d7a15e22e31adfbab698eab71/; sid:903200877; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c0:dc:f4:41:91:f4:e4:10:0b:a5:3e:97:0a:0b:2f:9d:c5:26:5b:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0dcf44191f4e4100ba53e970a0b2f9dc5265b53/; sid:903200878; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"01:87:15:5d:a8:7a:d3:6a:f4:38:04:28:c2:87:94:c0:ce:2d:6c:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0187155da87ad36af4380428c28794c0ce2d6c03/; sid:903200879; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c5:3d:fc:e6:3e:c4:c1:bc:d4:46:19:6f:f3:63:9a:fe:e9:3d:a0:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c53dfce63ec4c1bcd446196ff3639afee93da024/; sid:903200880; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7e:f9:fa:16:b9:15:42:f4:09:aa:62:db:1b:93:2e:c1:32:58:55:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7ef9fa16b91542f409aa62db1b932ec1325855b1/; sid:903200881; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"90:2a:46:fe:66:2e:84:f1:37:f5:8c:7b:eb:73:f4:4b:dd:49:98:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/902a46fe662e84f137f58c7beb73f44bdd499835/; sid:903200882; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"75:90:1d:7f:a7:13:b3:61:5c:f0:dd:0a:1e:e9:1f:91:7f:28:0d:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75901d7fa713b3615cf0dd0a1ee91f917f280d5c/; sid:903200883; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b0:f3:12:2c:1a:b2:8f:cd:3f:a5:6e:7d:88:73:7b:c0:5e:09:58:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0f3122c1ab28fcd3fa56e7d88737bc05e095854/; sid:903200884; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c3:11:9e:04:9e:97:20:72:67:5b:cc:40:8c:49:66:33:a6:0f:30:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3119e049e972072675bcc408c496633a60f305d/; sid:903200885; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4c:aa:72:70:8a:c9:86:39:ee:06:7a:2a:11:b8:64:fa:c1:82:f0:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4caa72708ac98639ee067a2a11b864fac182f0a8/; sid:903200886; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ab:f9:ea:90:a6:e2:fd:62:ad:c0:97:33:c0:30:7a:79:ba:e8:81:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/abf9ea90a6e2fd62adc09733c0307a79bae881c6/; sid:903200887; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ad:e6:61:19:82:c4:0d:11:84:c9:c2:b8:71:07:87:fc:a4:f4:b9:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ade6611982c40d1184c9c2b8710787fca4f4b9cc/; sid:903200888; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"30:46:18:64:27:2d:38:d8:dc:de:a0:3d:2b:35:06:1a:7d:47:14:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30461864272d38d8dcdea03d2b35061a7d471434/; sid:903200889; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1e:0d:5a:48:14:e0:76:94:0d:60:26:38:38:50:82:d8:6b:56:78:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e0d5a4814e076940d602638385082d86b5678ec/; sid:903200890; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c4:94:1b:3a:4a:e9:0a:b2:93:a7:78:77:ff:76:18:b5:0c:9f:11:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4941b3a4ae90ab293a77877ff7618b50c9f1196/; sid:903200891; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"31:26:2c:bb:37:7c:ce:57:12:3f:cb:4d:c8:bd:37:ae:84:dd:5e:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31262cbb377cce57123fcb4dc8bd37ae84dd5ec6/; sid:903200892; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e2:8a:48:04:ab:bc:42:42:9d:b8:9e:e4:fa:68:82:54:6d:38:ad:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e28a4804abbc42429db89ee4fa6882546d38ad16/; sid:903200893; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b2:86:16:ec:ac:37:a3:df:a1:3b:56:c7:54:70:0c:d5:b5:96:41:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b28616ecac37a3dfa13b56c754700cd5b5964117/; sid:903200894; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:1c:c7:8f:86:bc:ca:3d:a5:74:28:14:c5:12:a0:ca:0e:ed:6f:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/431cc78f86bcca3da5742814c512a0ca0eed6f3c/; sid:903200895; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ed:28:a9:c7:6b:5b:20:60:5b:2d:e6:61:dd:64:e6:43:d7:a0:29:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed28a9c76b5b20605b2de661dd64e643d7a0290a/; sid:903200896; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1d:8f:c2:98:b9:b8:32:5a:64:ad:fe:28:44:fe:45:b0:5b:60:b6:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d8fc298b9b8325a64adfe2844fe45b05b60b6fc/; sid:903200897; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"dd:ea:a7:f2:df:2b:38:e3:64:ed:38:ed:82:1b:d7:66:b6:1d:5f:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddeaa7f2df2b38e364ed38ed821bd766b61d5fe8/; sid:903200898; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b2:f7:84:c1:ca:50:79:01:bb:08:c6:06:fe:df:99:9e:db:bc:7a:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2f784c1ca507901bb08c606fedf999edbbc7ac6/; sid:903200899; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"34:aa:83:72:7f:2b:e5:43:fe:cc:45:f4:74:fc:5a:f4:6c:c7:72:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34aa83727f2be543fecc45f474fc5af46cc77287/; sid:903200900; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0e:ea:47:b5:89:df:cf:39:8f:87:59:37:5d:7e:d1:2c:1a:e0:3b:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0eea47b589dfcf398f8759375d7ed12c1ae03b54/; sid:903200901; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"2f:46:39:d4:3d:4d:e2:8a:bb:27:ad:d8:b9:3f:e7:17:6d:0c:2d:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2f4639d43d4de28abb27add8b93fe7176d0c2d37/; sid:903200902; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7c:29:b5:12:f5:2f:63:53:60:5c:f4:23:2e:f8:d8:61:f2:ab:8e:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c29b512f52f6353605cf4232ef8d861f2ab8e61/; sid:903200903; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"91:24:76:50:e0:75:eb:5a:0c:de:45:58:b7:c5:37:59:60:97:05:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91247650e075eb5a0cde4558b7c53759609705e8/; sid:903200904; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"94:04:a1:e8:15:f3:f0:10:ac:d0:8a:8c:9e:e7:a8:2f:3e:fc:02:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9404a1e815f3f010acd08a8c9ee7a82f3efc0289/; sid:903200905; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f6:98:f1:0d:b0:75:b6:40:76:e7:41:61:10:9e:33:20:bb:1e:a9:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f698f10db075b64076e74161109e3320bb1ea92f/; sid:903200906; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1e:09:60:1c:15:4e:7a:fe:df:a3:31:ca:30:32:57:8f:77:e2:60:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e09601c154e7afedfa331ca3032578f77e260d5/; sid:903200907; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f2:46:46:0f:04:8c:74:e5:14:ed:c8:cb:63:73:e1:bc:de:34:81:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f246460f048c74e514edc8cb6373e1bcde348197/; sid:903200908; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"42:ff:09:b1:69:b3:6e:48:72:fa:91:c3:34:8a:8f:c1:74:87:85:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/42ff09b169b36e4872fa91c3348a8fc174878568/; sid:903200909; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"73:ec:e1:b6:4a:6d:c9:0a:4d:e2:7d:74:88:4c:57:a6:7d:8d:09:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73ece1b64a6dc90a4de27d74884c57a67d8d09ef/; sid:903200910; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e7:68:58:cc:69:64:b1:0d:c4:0f:c2:9d:ac:bc:11:f9:7b:6a:25:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e76858cc6964b10dc40fc29dacbc11f97b6a25e1/; sid:903200911; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:f2:d0:b8:20:33:3e:e2:82:ac:14:77:52:c9:b1:67:1b:ac:39:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37f2d0b820333ee282ac147752c9b1671bac39e8/; sid:903200912; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"f5:3a:5c:0e:2c:9f:9f:17:08:b1:cf:27:af:cd:72:cc:16:7e:84:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f53a5c0e2c9f9f1708b1cf27afcd72cc167e842d/; sid:903200913; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bb:e9:ee:9d:5c:04:b4:ae:df:00:58:6a:52:6b:50:01:03:e1:76:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bbe9ee9d5c04b4aedf00586a526b500103e176bf/; sid:903200914; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"99:a2:69:8a:14:19:89:ad:69:c5:d4:29:5b:1c:ef:08:c1:f3:51:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99a2698a141989ad69c5d4295b1cef08c1f35117/; sid:903200915; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"79:4d:0f:0f:f4:ad:a9:74:36:72:2c:92:02:0d:1b:d3:c5:3a:ee:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/794d0f0ff4ada97436722c92020d1bd3c53aee55/; sid:903200916; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"15:13:e1:07:0a:63:53:40:8c:cd:f5:50:f8:cf:b9:28:29:e2:ce:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1513e1070a6353408ccdf550f8cfb92829e2ce38/; sid:903200917; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"68:d9:04:5b:9a:e8:96:ed:4e:26:d1:d0:e3:e1:a6:82:5a:f1:d9:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68d9045b9ae896ed4e26d1d0e3e1a6825af1d977/; sid:903200918; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4d:14:3a:5b:5f:5f:e1:42:8f:a1:5b:94:4e:13:a7:9f:14:ab:a9:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d143a5b5f5fe1428fa15b944e13a79f14aba985/; sid:903200919; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4c:5d:cd:6a:01:67:4a:5c:3f:14:1e:97:0a:a5:b1:1c:bd:8d:f7:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c5dcd6a01674a5c3f141e970aa5b11cbd8df778/; sid:903200920; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6b:cd:24:dc:af:e8:eb:bf:49:55:ae:55:9a:72:0a:21:89:ed:0b:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6bcd24dcafe8ebbf4955ae559a720a2189ed0be2/; sid:903200921; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5e:f7:32:aa:d1:33:94:6a:27:5f:e4:91:e3:1e:77:54:fa:95:f6:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ef732aad133946a275fe491e31e7754fa95f607/; sid:903200922; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"d2:1d:32:3e:19:d7:5d:1f:d7:b8:5c:0b:4a:50:f0:6c:92:71:15:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d21d323e19d75d1fd7b85c0b4a50f06c9271159a/; sid:903200923; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"11:47:94:74:33:f2:61:bc:d2:cd:8f:50:84:61:e0:18:98:c3:96:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1147947433f261bcd2cd8f508461e01898c3960b/; sid:903200924; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:f0:59:b0:fb:d2:a4:a8:68:e5:65:d1:62:e6:15:26:59:4f:02:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a4f059b0fbd2a4a868e565d162e61526594f026c/; sid:903200925; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"41:38:20:20:25:25:ec:61:22:ad:b5:87:a2:15:a9:dd:d2:ef:86:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/413820202525ec6122adb587a215a9ddd2ef86f0/; sid:903200926; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"75:10:1b:de:05:22:22:42:a1:ca:5b:08:04:2c:a4:0d:b7:40:e1:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75101bde05222242a1ca5b08042ca40db740e1c2/; sid:903200927; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"50:ce:57:06:3f:81:52:7b:32:57:f4:76:92:4b:7a:78:3c:91:6c:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50ce57063f81527b3257f476924b7a783c916ce8/; sid:903200928; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"63:bf:ab:cf:d3:45:f9:4e:c9:9a:fd:5f:62:00:fa:3d:44:87:f7:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63bfabcfd345f94ec99afd5f6200fa3d4487f764/; sid:903200929; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"18:69:a4:09:c3:62:8c:c3:ec:d7:b6:f6:14:10:cb:3d:16:be:f1:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1869a409c3628cc3ecd7b6f61410cb3d16bef14d/; sid:903200930; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"44:69:3a:76:05:38:0b:9d:a9:f6:4e:52:7e:2b:0e:38:22:02:d9:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44693a7605380b9da9f64e527e2b0e382202d9c3/; sid:903200931; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9a:80:f1:1c:bf:c7:b0:94:be:ab:c0:3a:84:64:4f:72:52:d7:8a:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a80f11cbfc7b094beabc03a84644f7252d78a5e/; sid:903200932; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"60:36:13:e9:d4:7b:a1:25:57:8d:83:37:71:d3:82:2a:65:3f:ef:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/603613e9d47ba125578d833771d3822a653fef21/; sid:903200933; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5f:6d:61:8c:e9:06:e0:66:6c:14:a9:49:6f:29:d6:6c:7d:d1:36:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f6d618ce906e0666c14a9496f29d66c7dd13692/; sid:903200934; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ae:fd:38:c5:55:44:01:59:a6:fb:d7:69:6a:7c:f3:db:3c:98:23:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aefd38c555440159a6fbd7696a7cf3db3c982341/; sid:903200935; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"31:7b:01:97:ce:59:19:6e:f6:8f:01:cb:88:fa:86:ae:05:5b:40:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/317b0197ce59196ef68f01cb88fa86ae055b4072/; sid:903200936; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Send-Safe C&C)"; tls_cert_fingerprint; content:"b0:bb:e3:da:e1:eb:45:80:64:c6:19:80:1d:05:a8:dc:5e:23:39:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0bbe3dae1eb458064c619801d05a8dc5e233934/; sid:903200937; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"76:9b:c6:c0:89:c0:34:3a:d1:f7:bd:17:96:7e:e8:0d:e8:23:dd:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/769bc6c089c0343ad1f7bd17967ee80de823dd29/; sid:903200938; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"6d:41:79:00:03:63:e8:a7:15:aa:cc:db:be:28:93:89:64:fb:58:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d4179000363e8a715aaccdbbe28938964fb58de/; sid:903200939; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6f:ed:d7:7d:dd:f2:dc:6b:63:6a:6d:30:63:a4:4c:6d:8d:43:e1:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fedd77dddf2dc6b636a6d3063a44c6d8d43e124/; sid:903200940; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1c:83:57:ec:56:4e:a1:f6:38:16:58:01:22:47:01:f5:65:f1:d3:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c8357ec564ea1f638165801224701f565f1d3d8/; sid:903200941; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4b:96:aa:73:71:b9:d5:5d:f6:f9:2e:9e:c8:07:5d:93:a3:11:55:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4b96aa7371b9d55df6f92e9ec8075d93a31155f7/; sid:903200942; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e3:53:d2:3f:26:d9:3a:a0:26:74:1c:9c:dd:a3:8b:16:fc:aa:a7:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e353d23f26d93aa026741c9cdda38b16fcaaa77b/; sid:903200943; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"0d:41:87:12:21:70:67:91:a2:62:03:f9:61:7b:85:97:23:ff:b2:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0d41871221706791a26203f9617b859723ffb243/; sid:903200944; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"5f:bd:f2:63:05:6f:b0:af:93:e7:7e:71:88:4a:a6:2c:c3:7f:bd:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fbdf263056fb0af93e77e71884aa62cc37fbd3a/; sid:903200945; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"40:d4:fe:fe:24:51:04:20:a9:7a:1d:7d:34:ec:5c:47:43:cf:1e:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/40d4fefe24510420a97a1d7d34ec5c4743cf1e86/; sid:903200946; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d1:c7:40:82:fa:51:37:90:5b:86:75:aa:05:4a:0b:ae:fa:5f:76:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1c74082fa5137905b8675aa054a0baefa5f7650/; sid:903200947; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"8f:7e:4e:31:ce:31:6e:3f:ab:9b:a5:34:6c:f4:2e:bb:0f:ed:2d:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f7e4e31ce316e3fab9ba5346cf42ebb0fed2d85/; sid:903200948; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"20:5c:00:27:1c:9c:2d:ce:dc:37:15:9b:c4:44:25:63:6c:83:7d:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/205c00271c9c2dcedc37159bc44425636c837d89/; sid:903200949; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:39:15:2c:6f:05:28:20:44:4b:2c:84:44:30:48:d8:d3:6d:86:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c739152c6f052820444b2c84443048d8d36d862a/; sid:903200950; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"23:ea:bd:a9:c6:7f:0a:0d:ee:3a:12:fd:ce:f1:fd:e5:84:a0:0f:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/23eabda9c67f0a0dee3a12fdcef1fde584a00f44/; sid:903200951; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9f:47:cb:1f:50:dc:e2:bd:73:ce:db:97:6c:21:d6:19:9a:e6:eb:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9f47cb1f50dce2bd73cedb976c21d6199ae6ebe7/; sid:903200952; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"59:80:32:0f:98:88:1d:4b:53:f6:0f:82:2f:d1:49:fb:08:4a:55:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5980320f98881d4b53f60f822fd149fb084a5538/; sid:903200953; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"61:70:cb:38:ea:ab:de:35:c9:36:fe:42:2a:51:e4:85:cf:12:47:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6170cb38eaabde35c936fe422a51e485cf1247a5/; sid:903200954; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"70:e9:0c:3e:40:fd:b8:b0:04:f9:a5:ec:13:f3:f2:8f:d0:0c:aa:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/70e90c3e40fdb8b004f9a5ec13f3f28fd00caa44/; sid:903200955; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:b6:6d:0d:5a:70:94:88:ab:7f:d4:fe:e3:8e:27:ee:a2:8e:b4:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77b66d0d5a709488ab7fd4fee38e27eea28eb402/; sid:903200956; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cf:9c:47:c1:b2:a0:3a:61:8c:09:b7:f9:a2:0f:32:ef:3b:0d:83:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf9c47c1b2a03a618c09b7f9a20f32ef3b0d8337/; sid:903200957; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"c8:6e:4f:26:df:15:86:16:14:ca:9b:d4:73:6c:b9:ad:29:c4:b6:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c86e4f26df15861614ca9bd4736cb9ad29c4b647/; sid:903200958; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"eb:c2:9e:39:37:8a:fa:48:0a:ef:79:4b:bb:6e:89:b4:ab:d5:e5:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ebc29e39378afa480aef794bbb6e89b4abd5e516/; sid:903200959; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"73:33:25:89:f7:b9:5b:d3:ae:f2:8d:ab:94:a4:10:1f:16:9d:3b:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73332589f7b95bd3aef28dab94a4101f169d3b41/; sid:903200960; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1d:4b:e8:f1:25:61:9b:be:6e:d8:15:35:79:e8:78:de:bf:73:69:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d4be8f125619bbe6ed8153579e878debf7369a4/; sid:903200961; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4c:17:e1:73:f7:46:b6:8c:bc:68:eb:38:e6:a3:58:c0:54:4e:c7:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c17e173f746b68cbc68eb38e6a358c0544ec718/; sid:903200962; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:04:d0:bd:b3:94:44:39:67:a8:b6:5d:43:21:a0:8f:5c:f1:24:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e904d0bdb394443967a8b65d4321a08f5cf124c6/; sid:903200963; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"47:e5:12:d9:b8:b3:78:01:fc:0b:ed:77:f2:a1:0d:61:d5:4a:e5:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/47e512d9b8b37801fc0bed77f2a10d61d54ae572/; sid:903200964; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b5:86:80:d6:a6:c2:c8:68:de:0f:ca:1d:4a:b6:f3:d3:60:cf:5d:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b58680d6a6c2c868de0fca1d4ab6f3d360cf5dc9/; sid:903200965; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:00:08:2b:ee:55:ae:92:82:5f:94:f5:fa:f4:fe:3e:43:3a:72:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4300082bee55ae92825f94f5faf4fe3e433a723c/; sid:903200966; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2e:cb:96:97:2a:ff:84:a8:65:37:aa:3d:75:c2:58:e3:00:f4:d7:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2ecb96972aff84a86537aa3d75c258e300f4d767/; sid:903200967; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"19:da:07:60:77:84:b4:bb:3b:d1:50:9b:c8:e8:0c:a4:b9:1e:59:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19da07607784b4bb3bd1509bc8e80ca4b91e59ee/; sid:903200968; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2f:ac:ee:cc:fe:2d:d3:d7:4d:aa:ba:ff:af:00:1f:1b:ae:ed:3b:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2faceeccfe2dd3d74daabaffaf001f1baeed3b25/; sid:903200969; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"19:3d:f8:7a:a0:1c:36:2b:4d:d2:6f:0c:db:9c:a3:b1:95:8e:b9:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/193df87aa01c362b4dd26f0cdb9ca3b1958eb965/; sid:903200970; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"52:bf:e9:b1:3e:5c:ba:c4:97:94:cc:83:e1:f3:4c:3c:53:80:83:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52bfe9b13e5cbac49794cc83e1f34c3c538083a0/; sid:903200971; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"60:15:02:2b:12:f4:f1:37:b4:5d:72:38:ef:cd:32:9b:27:7f:77:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6015022b12f4f137b45d7238efcd329b277f7736/; sid:903200972; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"fc:8e:bd:31:14:76:7c:33:5c:5b:85:c3:f7:b5:de:ff:44:9d:aa:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc8ebd3114767c335c5b85c3f7b5deff449daaf5/; sid:903200973; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2e:8e:3e:0d:51:c3:dd:ae:f3:a0:91:27:24:d9:ce:83:75:02:61:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e8e3e0d51c3ddaef3a0912724d9ce837502612f/; sid:903200974; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"e2:75:ed:91:3d:9f:04:08:8e:20:67:d4:1b:49:ca:90:f4:98:f2:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e275ed913d9f04088e2067d41b49ca90f498f235/; sid:903200975; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"34:a9:2e:41:d4:cf:61:f1:fc:51:0e:40:af:d3:62:d2:dd:c0:0f:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34a92e41d4cf61f1fc510e40afd362d2ddc00ff7/; sid:903200976; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"43:63:59:9d:a4:1d:93:47:e8:2e:9c:a9:3c:2e:1a:90:0e:ba:0b:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4363599da41d9347e82e9ca93c2e1a900eba0b2b/; sid:903200977; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6b:ce:6b:d7:fa:5d:26:8b:32:e3:43:2d:28:6c:24:67:90:a3:08:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6bce6bd7fa5d268b32e3432d286c246790a30833/; sid:903200978; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b8:0d:52:b8:29:67:b9:43:d6:32:8b:b2:70:06:74:12:d1:9a:3a:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b80d52b82967b943d6328bb270067412d19a3a78/; sid:903200979; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5a:2c:d9:79:b7:e3:a8:19:4d:e4:23:65:e1:d6:4f:7f:09:6b:e7:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5a2cd979b7e3a8194de42365e1d64f7f096be7d8/; sid:903200980; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fc:49:13:72:e2:53:cf:8e:b5:9a:0b:90:fa:72:5a:0d:ce:31:eb:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc491372e253cf8eb59a0b90fa725a0dce31eb9a/; sid:903200981; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c8:d9:fc:ad:7e:eb:b3:a7:a9:fa:b9:74:78:b1:99:34:bb:98:bd:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8d9fcad7eebb3a7a9fab97478b19934bb98bdfa/; sid:903200982; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2a:0a:86:07:0b:e3:2a:4b:d2:24:3d:54:75:35:4b:7d:65:2f:de:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a0a86070be32a4bd2243d5475354b7d652fde3c/; sid:903200983; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"de:e6:1e:7d:12:22:3c:b2:d0:fc:9c:30:fa:7e:4a:d1:c8:e0:75:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dee61e7d12223cb2d0fc9c30fa7e4ad1c8e07518/; sid:903200984; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"35:42:c9:f3:be:f6:cd:ac:e6:9a:35:f5:6a:1b:94:65:e2:6e:d7:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3542c9f3bef6cdace69a35f56a1b9465e26ed712/; sid:903200985; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"38:ae:a7:09:04:79:5d:cb:af:1c:be:95:10:07:5e:3d:9c:e4:fc:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38aea70904795dcbaf1cbe9510075e3d9ce4fc02/; sid:903200986; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"39:db:50:ef:01:84:10:2a:26:6c:a2:e3:ca:d0:f9:8f:ef:b8:9c:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39db50ef0184102a266ca2e3cad0f98fefb89c82/; sid:903200987; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"fb:08:b6:29:de:fd:12:9a:46:99:77:4e:c6:0b:50:05:80:9e:ab:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb08b629defd129a4699774ec60b5005809eabad/; sid:903200988; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d6:e1:46:db:65:1d:3d:37:e2:d0:73:e8:d8:2d:e6:f2:25:0b:97:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d6e146db651d3d37e2d073e8d82de6f2250b9791/; sid:903200989; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f2:a6:19:75:cb:54:1e:6a:62:ed:8c:a5:21:40:20:10:8d:92:2a:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f2a61975cb541e6a62ed8ca5214020108d922a14/; sid:903200990; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"21:ac:11:e8:f3:cf:cc:86:cf:79:d7:89:e7:45:1b:df:95:b5:14:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/21ac11e8f3cfcc86cf79d789e7451bdf95b5140a/; sid:903200991; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ec:c6:58:86:2a:d7:2d:fa:14:3d:7c:24:26:52:1a:54:f6:66:b9:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecc658862ad72dfa143d7c2426521a54f666b9df/; sid:903200992; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"68:2c:c8:69:54:4e:6b:ee:be:37:15:9b:de:d9:b2:f6:15:91:37:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/682cc869544e6beebe37159bded9b2f61591378f/; sid:903200993; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"94:cf:c5:8c:0a:6d:44:53:27:cf:45:89:53:10:2b:56:17:e7:fe:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94cfc58c0a6d445327cf458953102b5617e7fe29/; sid:903200994; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:3f:e5:08:cb:81:f3:44:b9:d0:d1:e6:1c:88:ec:e9:bb:9c:8c:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a33fe508cb81f344b9d0d1e61c88ece9bb9c8cbd/; sid:903200995; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"53:3d:b5:0c:5b:cd:82:d7:2d:07:9c:2a:a8:43:aa:57:cf:e6:9d:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/533db50c5bcd82d72d079c2aa843aa57cfe69d01/; sid:903200996; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"68:78:b4:78:3c:f1:ab:68:47:16:1e:bb:10:1a:63:84:3f:06:a9:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6878b4783cf1ab6847161ebb101a63843f06a98e/; sid:903200997; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"cf:66:ea:3b:60:88:b8:10:0b:69:9e:31:6f:84:cd:7d:e7:fc:76:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf66ea3b6088b8100b699e316f84cd7de7fc76ab/; sid:903200998; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"7a:0b:0f:ca:51:e4:97:c9:aa:0d:c4:da:aa:14:2f:56:37:05:fe:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a0b0fca51e497c9aa0dc4daaa142f563705fe43/; sid:903200999; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"82:26:83:ca:ec:7d:fe:13:7b:f4:7b:f9:ca:17:6a:9e:94:d9:dc:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/822683caec7dfe137bf47bf9ca176a9e94d9dc8b/; sid:903201000; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"35:ba:f2:9f:7f:a2:3e:3d:46:fb:16:e7:9f:b0:23:54:05:a1:99:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35baf29f7fa23e3d46fb16e79fb0235405a1998a/; sid:903201001; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"7f:48:d4:aa:cf:79:49:e3:de:64:6c:61:0b:9c:59:79:c6:8e:c5:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f48d4aacf7949e3de646c610b9c5979c68ec52f/; sid:903201002; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"eb:86:5a:d6:ff:29:40:55:52:f7:68:c3:3c:3a:cc:4c:b8:d9:b7:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb865ad6ff29405552f768c33c3acc4cb8d9b7dd/; sid:903201003; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bb:e1:6a:1c:d4:69:b6:d1:ab:99:bc:5d:c4:b2:43:8f:b6:80:1e:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bbe16a1cd469b6d1ab99bc5dc4b2438fb6801e60/; sid:903201004; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d2:8b:e4:34:6e:fc:d8:7d:17:d3:59:5d:0d:8c:86:d2:22:e0:54:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d28be4346efcd87d17d3595d0d8c86d222e05420/; sid:903201005; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d4:fc:c5:a2:02:85:30:22:a6:1c:bf:06:f3:5d:c5:20:25:de:de:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4fcc5a202853022a61cbf06f35dc52025dede3a/; sid:903201006; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"35:2c:39:c3:b8:0f:00:f7:7b:49:a0:d3:f9:16:b7:a0:a6:e8:56:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/352c39c3b80f00f77b49a0d3f916b7a0a6e856f8/; sid:903201007; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ec:5b:81:f7:e1:ea:b3:7f:d7:d6:61:72:d8:8e:f6:91:fd:dd:ff:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec5b81f7e1eab37fd7d66172d88ef691fdddff06/; sid:903201008; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fc:3f:b5:57:67:2e:17:94:e4:d7:9f:eb:7d:d7:cc:e5:b5:22:ce:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc3fb557672e1794e4d79feb7dd7cce5b522ce36/; sid:903201009; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"38:17:74:d7:7d:04:ae:c0:79:63:b6:5c:c2:c9:c5:94:5f:9d:43:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/381774d77d04aec07963b65cc2c9c5945f9d432b/; sid:903201010; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b6:c2:df:a6:71:2c:2d:55:ae:f0:71:61:c4:5f:bf:3b:a8:7a:a4:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6c2dfa6712c2d55aef07161c45fbf3ba87aa4ed/; sid:903201011; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"08:c3:95:a9:2e:1b:23:46:79:3f:71:fc:69:2e:9b:78:bf:ec:e0:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08c395a92e1b2346793f71fc692e9b78bfece072/; sid:903201012; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5a:66:3b:6a:0a:ab:e4:47:bb:52:ab:b9:e0:cb:c8:b7:da:f0:5e:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5a663b6a0aabe447bb52abb9e0cbc8b7daf05e7b/; sid:903201013; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0f:3c:8f:f0:2d:1c:b8:03:77:f8:e5:dd:33:41:7a:18:17:4e:40:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f3c8ff02d1cb80377f8e5dd33417a18174e4099/; sid:903201014; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0e:44:c7:aa:ad:d1:18:6c:17:f4:f1:36:4e:37:22:c1:72:a7:ce:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e44c7aaadd1186c17f4f1364e3722c172a7ce2e/; sid:903201015; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1d:6d:1f:2b:fb:ca:de:17:be:42:33:c8:8d:ed:d2:ce:b8:02:60:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d6d1f2bfbcade17be4233c88dedd2ceb802602e/; sid:903201016; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c4:26:79:3f:8b:04:33:55:9e:10:39:6d:37:69:e4:c2:06:cf:10:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c426793f8b0433559e10396d3769e4c206cf10d3/; sid:903201017; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"63:75:b2:82:75:fa:7c:95:91:2c:a1:20:0c:9e:02:87:a6:5a:ad:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6375b28275fa7c95912ca1200c9e0287a65aadef/; sid:903201018; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"08:ca:6e:54:08:95:38:df:6b:3d:c4:71:d4:51:af:89:2e:86:31:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08ca6e54089538df6b3dc471d451af892e8631dc/; sid:903201019; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"fe:76:6e:a5:72:67:b8:d9:fa:e9:78:8b:02:65:30:7b:53:d6:59:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe766ea57267b8d9fae9788b0265307b53d659cf/; sid:903201020; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bd:d7:80:30:c8:94:db:d5:d7:2c:d6:3e:d8:c2:8d:55:de:a6:dd:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bdd78030c894dbd5d72cd63ed8c28d55dea6dd3f/; sid:903201021; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7b:5a:8f:28:9d:bd:70:8e:98:a7:f8:df:1e:05:fd:0a:b4:e2:8f:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b5a8f289dbd708e98a7f8df1e05fd0ab4e28fec/; sid:903201022; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c3:ca:0b:70:d9:1e:d8:4b:aa:00:bc:59:6a:7d:64:b8:8d:71:e9:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3ca0b70d91ed84baa00bc596a7d64b88d71e92e/; sid:903201023; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"49:39:8e:9d:0b:17:16:c0:67:f5:46:b3:5d:c2:f6:c2:b3:2d:1a:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/49398e9d0b1716c067f546b35dc2f6c2b32d1a7f/; sid:903201024; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:6d:e6:95:15:dc:79:07:8a:91:84:78:a1:ba:35:26:52:65:2f:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d6de69515dc79078a918478a1ba352652652f5e/; sid:903201025; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fb:78:dc:77:f6:db:e6:c1:72:c2:0d:9c:a9:ac:d6:2e:08:f2:3f:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb78dc77f6dbe6c172c20d9ca9acd62e08f23fac/; sid:903201026; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:db:eb:f3:f0:9c:23:87:3a:a2:5c:78:cf:5a:ac:95:e2:9e:a7:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/efdbebf3f09c23873aa25c78cf5aac95e29ea7e6/; sid:903201027; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"40:21:5a:e3:76:a7:0f:62:2c:c4:2e:53:2c:38:7a:8c:12:56:96:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/40215ae376a70f622cc42e532c387a8c125696e1/; sid:903201028; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f5:fe:9f:02:ba:6e:b3:5a:f4:3c:cd:16:88:a9:ef:6a:40:3f:8c:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5fe9f02ba6eb35af43ccd1688a9ef6a403f8cfb/; sid:903201029; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"65:1f:ce:4f:01:fb:51:71:fe:68:fa:cf:2b:24:5d:9e:3e:6d:8c:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/651fce4f01fb5171fe68facf2b245d9e3e6d8c47/; sid:903201030; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8d:ce:aa:6c:43:39:4c:f8:a9:c3:cc:3c:3f:eb:9b:a3:c2:6a:64:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8dceaa6c43394cf8a9c3cc3c3feb9ba3c26a64c8/; sid:903201031; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"95:8b:5f:15:4d:c1:91:3e:cf:de:28:09:b0:62:25:9a:a7:07:b9:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/958b5f154dc1913ecfde2809b062259aa707b9f6/; sid:903201032; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"cf:27:cc:e5:3a:52:00:81:d0:5c:a4:dc:28:a8:99:0b:74:f6:03:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf27cce53a520081d05ca4dc28a8990b74f60380/; sid:903201033; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"91:45:d9:97:96:3a:50:b9:10:7c:45:f0:57:d9:51:07:a6:32:96:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9145d997963a50b9107c45f057d95107a63296c3/; sid:903201034; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4e:37:fc:e8:59:65:65:78:9f:d8:73:42:2f:b7:74:27:22:76:70:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e37fce8596565789fd873422fb7742722767064/; sid:903201035; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"63:eb:bb:74:f1:b0:b6:6f:94:2b:11:3d:ef:39:27:e8:5a:3a:24:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63ebbb74f1b0b66f942b113def3927e85a3a2491/; sid:903201036; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e1:8c:66:d7:33:02:24:4d:15:8e:bd:d0:f1:41:dc:39:5a:48:8e:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e18c66d73302244d158ebdd0f141dc395a488ed4/; sid:903201037; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"af:f4:f3:a7:28:f1:65:be:e5:ca:7c:dc:1f:94:71:d1:7d:49:1a:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aff4f3a728f165bee5ca7cdc1f9471d17d491a62/; sid:903201038; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f6:ad:cf:0d:68:26:5b:5f:f0:27:ca:f5:2c:eb:ab:00:a6:64:b7:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f6adcf0d68265b5ff027caf52cebab00a664b7e5/; sid:903201039; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:f9:2a:f9:23:29:5b:89:4b:f7:b9:a6:65:78:49:32:bd:73:e8:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eff92af923295b894bf7b9a665784932bd73e81c/; sid:903201040; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:95:04:c3:07:58:13:83:03:31:60:16:c1:f7:c8:fd:71:c1:46:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c19504c30758138303316016c1f7c8fd71c146ea/; sid:903201041; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b7:ca:92:19:f3:ff:f0:9c:e2:d8:ac:6a:03:22:df:3f:21:b0:bc:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b7ca9219f3fff09ce2d8ac6a0322df3f21b0bcf3/; sid:903201042; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"63:d1:6c:e6:20:7e:16:c7:3b:38:68:ef:ef:f3:03:2b:92:90:f3:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63d16ce6207e16c73b3868efeff3032b9290f3c6/; sid:903201043; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"72:e6:13:64:d9:f0:fe:15:e5:cd:0f:d6:af:c4:b2:12:cf:cd:64:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72e61364d9f0fe15e5cd0fd6afc4b212cfcd6470/; sid:903201044; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:50:74:00:79:31:00:3c:76:ae:51:dc:74:13:03:b8:6b:e6:fa:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e25074007931003c76ae51dc741303b86be6fa06/; sid:903201045; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"b5:08:31:a1:d3:19:9b:41:d5:2d:43:76:c5:ca:ea:ce:e0:5a:4a:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b50831a1d3199b41d52d4376c5caeacee05a4ae3/; sid:903201046; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"93:82:0f:72:18:11:62:9f:f0:d3:51:0a:5a:e3:ec:72:f2:f9:26:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93820f721811629ff0d3510a5ae3ec72f2f926ef/; sid:903201047; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1c:b5:36:f2:bb:f0:7c:9c:6d:97:b1:58:aa:81:b2:ef:ec:ec:03:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1cb536f2bbf07c9c6d97b158aa81b2efecec0330/; sid:903201048; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"18:62:c7:77:ba:bf:29:8f:e5:a9:34:06:e4:dc:84:56:d7:18:ab:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1862c777babf298fe5a93406e4dc8456d718abcf/; sid:903201049; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"1b:3f:95:27:55:d5:14:33:ae:04:1d:28:2e:a0:48:32:cc:6d:e6:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b3f952755d51433ae041d282ea04832cc6de62d/; sid:903201050; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Worm.Dorkbot C&C)"; tls_cert_fingerprint; content:"73:1c:58:9f:f2:87:4c:29:da:6b:93:7d:23:ae:cb:2d:c9:02:c5:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/731c589ff2874c29da6b937d23aecb2dc902c5f7/; sid:903201051; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f6:85:d3:97:2d:c7:c5:7e:11:aa:54:33:22:38:af:1f:e6:e8:32:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f685d3972dc7c57e11aa54332238af1fe6e83275/; sid:903201052; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9d:9a:36:1d:a8:12:ec:3f:2e:53:58:29:6f:4c:e3:00:04:57:2e:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d9a361da812ec3f2e5358296f4ce30004572e09/; sid:903201053; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"93:74:79:06:0f:4e:a9:36:17:58:78:49:b2:58:b4:fd:89:13:34:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/937479060f4ea93617587849b258b4fd891334d5/; sid:903201054; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"37:29:80:33:35:df:a5:e6:27:ab:ab:2b:bb:bb:fc:bb:c3:0a:c2:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3729803335dfa5e627abab2bbbbbfcbbc30ac29f/; sid:903201055; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7e:4d:40:66:c5:5d:43:bf:6b:d6:03:70:3a:49:2a:30:12:5a:c4:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e4d4066c55d43bf6bd603703a492a30125ac42d/; sid:903201056; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f3:cb:ce:dc:bd:89:b6:11:6e:f5:d6:1c:a3:70:b6:59:58:a0:76:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f3cbcedcbd89b6116ef5d61ca370b65958a076a8/; sid:903201057; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"d3:44:31:0c:0f:fc:00:c4:3b:24:83:d6:2b:58:0b:1e:cc:3a:74:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d344310c0ffc00c43b2483d62b580b1ecc3a74ed/; sid:903201058; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9d:af:ef:75:1e:f9:be:79:4e:97:b3:aa:a5:e0:bf:e5:1f:ed:e7:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9dafef751ef9be794e97b3aaa5e0bfe51fede7b9/; sid:903201059; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"36:8e:6b:eb:6f:8d:2f:60:49:83:1f:e2:5d:d3:97:28:78:23:c5:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/368e6beb6f8d2f6049831fe25dd397287823c5e6/; sid:903201060; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"79:e1:0a:84:01:7c:36:a7:89:0f:49:fc:ab:7d:c7:cf:19:28:26:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79e10a84017c36a7890f49fcab7dc7cf192826d8/; sid:903201061; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"48:25:f4:a2:cb:22:4d:11:74:be:a7:10:04:35:6b:94:3e:42:a2:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4825f4a2cb224d1174bea71004356b943e42a2a4/; sid:903201062; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f4:67:2f:c4:46:ef:2d:54:26:5a:20:c3:90:13:4a:24:14:19:99:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4672fc446ef2d54265a20c390134a241419999a/; sid:903201063; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"79:66:ac:af:e2:f5:a9:5b:b0:ef:bc:22:4b:a1:13:3b:2e:61:3c:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7966acafe2f5a95bb0efbc224ba1133b2e613cf3/; sid:903201064; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ed:11:61:f8:1d:db:d9:a0:26:42:d4:56:10:b2:7d:ae:d2:a4:c5:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed1161f81ddbd9a02642d45610b27daed2a4c5d7/; sid:903201065; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4f:fa:3b:ad:4e:19:ab:b8:f2:88:16:d3:8f:8f:a2:12:8f:4e:46:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ffa3bad4e19abb8f28816d38f8fa2128f4e46b7/; sid:903201066; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ac:ad:78:6c:c0:4e:b0:77:50:2b:da:9f:49:c9:d5:94:82:78:58:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acad786cc04eb077502bda9f49c9d5948278582e/; sid:903201067; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"a8:93:ec:d6:17:c0:24:ae:e5:44:e6:a6:b2:8b:7c:25:69:19:8e:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a893ecd617c024aee544e6a6b28b7c2569198e73/; sid:903201068; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b7:eb:cb:b5:35:3f:f4:c6:db:73:2c:1b:39:be:ee:59:1f:b9:eb:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b7ebcbb5353ff4c6db732c1b39beee591fb9eb6e/; sid:903201069; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"54:56:8c:96:7d:5d:5c:df:30:20:61:41:38:72:11:da:6b:a8:6f:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54568c967d5d5cdf30206141387211da6ba86fb4/; sid:903201070; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"12:c7:aa:3e:41:69:ff:25:82:c2:82:45:ff:a5:b3:62:69:73:92:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12c7aa3e4169ff2582c28245ffa5b362697392c7/; sid:903201071; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"fe:70:95:63:01:28:be:29:75:23:27:6a:0f:af:af:5c:38:66:79:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe7095630128be297523276a0fafaf5c3866799d/; sid:903201072; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"87:f2:a4:24:a7:02:d0:a2:39:6e:60:70:53:49:17:4f:8d:59:44:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87f2a424a702d0a2396e60705349174f8d59440a/; sid:903201073; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"39:8b:91:3a:da:3f:59:62:e9:24:48:6d:ba:e6:68:cd:f9:c0:dc:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/398b913ada3f5962e924486dbae668cdf9c0dc72/; sid:903201074; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"de:2f:cb:51:5c:44:96:8f:d3:24:70:f8:e1:e3:73:fe:fa:8b:fb:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de2fcb515c44968fd32470f8e1e373fefa8bfb60/; sid:903201075; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b0:45:be:c6:fb:61:22:b0:74:7b:c2:74:38:50:aa:ab:78:68:e6:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b045bec6fb6122b0747bc2743850aaab7868e62a/; sid:903201076; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"38:b8:96:03:6e:33:46:1b:43:1f:f4:a0:4f:73:c3:bc:22:d4:7b:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38b896036e33461b431ff4a04f73c3bc22d47b76/; sid:903201077; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"13:d6:3d:e5:20:4a:6c:35:18:27:87:93:5c:85:16:46:6b:1f:cd:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/13d63de5204a6c35182787935c8516466b1fcdd3/; sid:903201078; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:6e:3c:06:9c:39:76:c3:f2:e9:7d:2a:96:4c:1f:c1:9d:38:b3:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/156e3c069c3976c3f2e97d2a964c1fc19d38b3fa/; sid:903201079; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"7d:f5:35:64:76:19:f3:8f:5f:e9:a9:f4:13:90:6a:b4:e3:55:90:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7df535647619f38f5fe9a9f413906ab4e355909a/; sid:903201080; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"11:53:e6:91:d5:41:23:4d:43:4e:a1:54:31:06:ec:c4:75:f3:06:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1153e691d541234d434ea1543106ecc475f30693/; sid:903201081; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"00:a9:3f:c7:4e:d0:00:bd:d1:d9:f0:dd:4f:5b:0e:d7:5a:f3:08:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00a93fc74ed000bdd1d9f0dd4f5b0ed75af30870/; sid:903201082; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"05:3d:41:cd:f0:74:9d:69:3a:79:2c:36:94:7c:16:a6:24:8b:b0:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/053d41cdf0749d693a792c36947c16a6248bb028/; sid:903201083; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f8:f7:06:09:91:e7:39:30:cd:56:4e:54:01:39:66:37:f9:5c:92:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f8f7060991e73930cd564e5401396637f95c92d4/; sid:903201084; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"df:fb:56:f3:20:7d:f4:d4:86:5a:3b:49:ed:bf:8f:27:d6:c7:1a:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dffb56f3207df4d4865a3b49edbf8f27d6c71a8e/; sid:903201085; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"64:f2:42:0c:fa:4b:ba:c2:e9:9d:18:b9:68:0a:17:90:ab:4d:da:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64f2420cfa4bbac2e99d18b9680a1790ab4ddaaf/; sid:903201086; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1f:73:41:b0:52:d1:f2:7b:19:76:3c:d0:c8:26:5a:f8:a1:31:05:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f7341b052d1f27b19763cd0c8265af8a13105d2/; sid:903201087; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d4:24:41:08:f9:4b:69:31:14:1c:13:b2:ae:e8:3d:b3:25:ee:05:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4244108f94b6931141c13b2aee83db325ee05bb/; sid:903201088; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2a:e6:52:44:aa:20:d9:92:d7:74:d4:af:37:01:65:43:e7:ff:46:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2ae65244aa20d992d774d4af37016543e7ff460c/; sid:903201089; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"39:65:1d:d1:be:23:36:9f:80:1b:47:79:ac:2d:7d:b8:65:e7:a2:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39651dd1be23369f801b4779ac2d7db865e7a246/; sid:903201090; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e3:f9:5e:ef:ca:a5:d6:d2:c5:82:95:31:ca:02:f9:f3:8c:da:12:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e3f95eefcaa5d6d2c5829531ca02f9f38cda12dc/; sid:903201091; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"73:cb:76:a3:cb:40:b8:31:0d:13:e8:2f:aa:df:58:f6:28:a1:96:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73cb76a3cb40b8310d13e82faadf58f628a1966d/; sid:903201092; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3f:64:b4:f1:24:67:b6:28:0e:7f:eb:46:82:8e:0b:a2:8e:5d:d1:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3f64b4f12467b6280e7feb46828e0ba28e5dd132/; sid:903201093; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"ff:79:aa:5a:96:00:09:d8:be:dd:89:0a:ba:98:19:36:bf:df:05:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff79aa5a960009d8bedd890aba981936bfdf0563/; sid:903201094; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"eb:4b:94:a0:ca:9a:0e:a2:67:5f:19:9d:dd:f3:8f:b7:dc:8c:95:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb4b94a0ca9a0ea2675f199dddf38fb7dc8c9524/; sid:903201095; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f7:73:47:64:58:ee:9b:27:25:f2:c0:a9:38:04:82:8b:44:69:0c:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f773476458ee9b2725f2c0a93804828b44690c7c/; sid:903201096; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8f:81:f1:8c:ee:57:c4:43:8a:8b:8d:ae:9f:34:ee:84:6c:61:92:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f81f18cee57c4438a8b8dae9f34ee846c61922f/; sid:903201097; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"dc:e3:02:80:28:02:8e:5b:2c:d6:ff:51:a6:b6:e5:65:9a:b1:d7:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dce3028028028e5b2cd6ff51a6b6e5659ab1d748/; sid:903201098; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6d:f3:da:62:54:fe:88:4f:56:32:0a:e2:8a:ca:a7:88:07:48:ea:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6df3da6254fe884f56320ae28acaa7880748ea96/; sid:903201099; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"41:d6:62:03:15:36:fd:5a:29:7e:c9:3a:ed:5e:d1:82:ee:cc:22:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/41d662031536fd5a297ec93aed5ed182eecc2262/; sid:903201100; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f8:65:e1:67:29:af:45:8b:4a:1e:d8:32:36:9c:31:4b:ad:e9:48:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f865e16729af458b4a1ed832369c314bade948bf/; sid:903201101; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"7a:90:9e:cc:ac:2b:cd:d2:41:e1:83:94:2b:46:ff:61:41:dd:17:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a909eccac2bcdd241e183942b46ff6141dd17af/; sid:903201102; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ea:84:51:0c:e3:b3:13:1f:42:c4:43:b9:8e:17:f2:7a:87:6e:cb:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ea84510ce3b3131f42c443b98e17f27a876ecbea/; sid:903201103; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2e:83:00:eb:08:31:fa:63:a3:fd:bd:4f:2a:a9:8c:f6:c9:9c:23:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e8300eb0831fa63a3fdbd4f2aa98cf6c99c23e9/; sid:903201104; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1e:5e:c7:fa:ed:c4:b3:16:c1:6a:b3:39:23:b7:79:c1:03:0c:e8:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e5ec7faedc4b316c16ab33923b779c1030ce8c0/; sid:903201105; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:7c:6c:d3:03:0a:68:77:6b:b8:44:ba:b1:cc:dc:c5:ed:8f:d5:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e97c6cd3030a68776bb844bab1ccdcc5ed8fd5cf/; sid:903201106; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"55:ae:98:5b:a6:45:3d:5c:d7:43:37:f0:ff:c8:07:53:ba:ec:f4:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55ae985ba6453d5cd74337f0ffc80753baecf441/; sid:903201107; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1f:2a:30:ef:c5:fd:50:3a:a7:ef:1f:0f:8e:f4:13:9c:c7:7f:b4:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f2a30efc5fd503aa7ef1f0f8ef4139cc77fb48c/; sid:903201108; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1a:94:d2:8c:20:94:79:6b:53:6d:30:31:70:9d:e0:fe:71:2a:13:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a94d28c2094796b536d3031709de0fe712a132a/; sid:903201109; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0b:c1:17:f5:02:4a:ab:93:84:29:84:83:72:06:ef:b8:50:25:8e:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0bc117f5024aab93842984837206efb850258ecb/; sid:903201110; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5f:a1:98:59:c4:df:2f:76:92:d0:68:a1:7d:77:21:e3:0f:51:2b:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fa19859c4df2f7692d068a17d7721e30f512b3c/; sid:903201111; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d0:67:d9:98:ee:a2:47:d9:24:f0:cb:b5:30:ce:87:a0:56:ff:59:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d067d998eea247d924f0cbb530ce87a056ff5933/; sid:903201112; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5c:5c:05:c4:95:83:42:0f:36:5a:08:74:8b:3f:77:af:6d:0e:10:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c5c05c49583420f365a08748b3f77af6d0e1093/; sid:903201113; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6d:de:75:ca:5c:fb:c0:fd:a3:b1:85:79:f5:d8:49:27:74:32:af:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6dde75ca5cfbc0fda3b18579f5d849277432af78/; sid:903201114; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"17:14:ea:54:c7:f0:d5:e8:01:c9:82:21:37:a7:94:b6:55:e4:45:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1714ea54c7f0d5e801c9822137a794b655e44529/; sid:903201115; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cf:20:0a:4e:cc:09:53:05:9b:cb:27:97:cc:70:fa:d6:e4:b7:f8:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf200a4ecc0953059bcb2797cc70fad6e4b7f818/; sid:903201116; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5c:18:50:56:e7:5d:41:b7:1a:fd:76:64:fd:ed:33:79:5d:f1:ed:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c185056e75d41b71afd7664fded33795df1edb5/; sid:903201117; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:b4:31:0a:34:54:3c:69:30:b1:c1:7a:bc:d7:3a:5b:45:c5:9f:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85b4310a34543c6930b1c17abcd73a5b45c59f5d/; sid:903201118; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"92:b8:64:81:9e:ae:20:f7:55:d7:09:23:87:25:3b:ba:59:04:13:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92b864819eae20f755d7092387253bba59041346/; sid:903201119; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"30:15:29:74:71:3e:1a:64:ea:8b:e4:7d:26:de:2d:aa:16:e2:49:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30152974713e1a64ea8be47d26de2daa16e249d2/; sid:903201120; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c0:c5:62:9b:2a:90:6a:67:b0:56:61:7c:01:58:b0:fc:b1:dc:3a:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0c5629b2a906a67b056617c0158b0fcb1dc3ad7/; sid:903201121; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0c:af:29:e9:a5:d3:8c:49:7b:13:64:06:d6:b0:25:52:a9:86:b8:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0caf29e9a5d38c497b136406d6b02552a986b88c/; sid:903201122; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:d9:94:1c:b6:27:b7:1f:0d:74:9e:5d:9d:b8:61:8c:4f:77:23:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06d9941cb627b71f0d749e5d9db8618c4f772327/; sid:903201123; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ee:19:5b:bb:70:b4:ba:a1:06:7d:f4:b3:63:ae:58:a7:e4:29:f5:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee195bbb70b4baa1067df4b363ae58a7e429f53a/; sid:903201124; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3f:ee:5c:28:b2:8e:f0:67:82:aa:18:89:9b:e1:16:c9:ab:0b:4f:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3fee5c28b28ef06782aa18899be116c9ab0b4ffc/; sid:903201125; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bf:5f:36:fc:13:0b:9e:14:3a:44:55:cb:82:3d:46:9d:d7:e9:a8:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf5f36fc130b9e143a4455cb823d469dd7e9a8d1/; sid:903201126; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:fb:d8:b6:0b:56:4f:49:36:82:4d:c8:22:6b:5c:52:50:5d:dd:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52fbd8b60b564f4936824dc8226b5c52505ddddb/; sid:903201127; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5e:48:8a:46:82:6e:e4:18:e6:bb:a5:6a:d9:03:72:90:d3:f8:be:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e488a46826ee418e6bba56ad9037290d3f8be52/; sid:903201128; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d7:7d:5c:09:f6:04:68:87:96:cc:60:26:33:df:e5:08:6d:2a:87:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d77d5c09f604688796cc602633dfe5086d2a87f3/; sid:903201129; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f8:e7:7b:39:6c:9e:89:d5:84:ec:ee:41:81:7b:40:54:1e:95:7a:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f8e77b396c9e89d584ecee41817b40541e957af0/; sid:903201130; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"87:d4:dd:71:55:3a:81:5c:ee:2c:71:b6:45:18:87:68:09:08:77:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87d4dd71553a815cee2c71b645188768090877a9/; sid:903201131; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2e:55:56:4a:1b:31:a9:92:93:2e:21:88:00:86:cc:a5:df:72:91:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e55564a1b31a992932e21880086cca5df72916b/; sid:903201132; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bb:14:ff:39:82:ae:18:b4:6a:e3:50:32:ff:44:ca:ed:0b:a1:d0:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb14ff3982ae18b46ae35032ff44caed0ba1d05a/; sid:903201133; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:e8:c5:9b:88:46:a0:16:b2:c0:0e:7d:07:c9:f0:9f:50:f7:0b:81"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52e8c59b8846a016b2c00e7d07c9f09f50f70b81/; sid:903201134; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"13:f3:00:e4:b4:33:97:fb:95:50:e3:24:e3:b0:4e:98:b4:d2:70:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/13f300e4b43397fb9550e324e3b04e98b4d270f7/; sid:903201135; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f9:8d:fa:31:74:ff:9c:4d:46:55:29:e7:e6:1f:53:9c:22:67:48:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f98dfa3174ff9c4d465529e7e61f539c22674835/; sid:903201136; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5e:17:82:5e:fe:d0:e6:d9:c4:03:a0:17:53:6a:ed:b1:be:5d:eb:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e17825efed0e6d9c403a017536aedb1be5deb58/; sid:903201137; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0e:a5:88:34:72:68:74:9a:d8:31:a7:18:8a:cc:6d:f0:0e:44:38:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ea588347268749ad831a7188acc6df00e443863/; sid:903201138; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e9:a1:28:3d:36:d1:79:0a:4d:a7:23:f3:18:3d:20:61:ec:09:9b:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9a1283d36d1790a4da723f3183d2061ec099b37/; sid:903201139; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5e:65:43:0b:ec:c5:c5:b1:11:33:2b:6f:57:da:36:f2:60:be:13:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e65430becc5c5b111332b6f57da36f260be13b9/; sid:903201140; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ac:64:85:38:41:1e:f8:73:fe:49:09:37:28:e8:36:ba:51:92:3f:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac648538411ef873fe49093728e836ba51923ffe/; sid:903201141; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"71:66:65:78:9c:85:bc:ae:38:43:30:9b:61:99:4d:2e:6c:b9:29:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/716665789c85bcae3843309b61994d2e6cb92975/; sid:903201142; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"bd:d3:52:d9:0e:b1:ba:49:34:73:24:de:b0:20:f7:15:4e:be:c1:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bdd352d90eb1ba49347324deb020f7154ebec18d/; sid:903201143; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"56:1e:b4:87:16:28:5b:bb:84:ce:04:c9:bd:1a:15:31:b9:f3:e0:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/561eb48716285bbb84ce04c9bd1a1531b9f3e0bd/; sid:903201144; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9c:c2:3c:94:02:d1:8a:e6:74:1e:0b:d2:bf:ad:79:d0:ff:57:10:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9cc23c9402d18ae6741e0bd2bfad79d0ff5710f1/; sid:903201145; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"28:b5:11:d0:9f:7a:0f:65:4d:22:0b:9b:04:9f:92:ab:3b:b5:13:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28b511d09f7a0f654d220b9b049f92ab3bb513fa/; sid:903201146; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"14:e9:7c:0d:73:dd:b4:94:ab:11:47:68:21:b4:99:9e:ed:99:6e:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14e97c0d73ddb494ab11476821b4999eed996ed8/; sid:903201147; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"51:d6:64:3c:f4:68:54:98:10:17:5e:e4:9f:83:79:f7:60:6a:eb:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/51d6643cf468549810175ee49f8379f7606aebd0/; sid:903201148; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0d:a0:45:61:36:76:e3:ae:73:8d:ef:ab:e9:76:de:56:c3:43:84:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0da045613676e3ae738defabe976de56c3438489/; sid:903201149; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"09:a8:18:c7:a0:2c:dd:e9:94:84:96:49:7e:37:05:80:6a:d7:ec:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09a818c7a02cdde9948496497e3705806ad7ecc9/; sid:903201150; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"43:ad:82:f2:bb:31:f4:4c:9d:43:df:fa:17:01:39:c9:f3:41:8e:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43ad82f2bb31f44c9d43dffa170139c9f3418ed2/; sid:903201151; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"48:84:f7:5f:6b:4c:31:8a:fc:86:63:2d:f4:bf:d6:57:30:8a:36:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4884f75f6b4c318afc86632df4bfd657308a3628/; sid:903201152; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"20:a0:61:39:2e:5a:4d:0b:0e:9b:02:73:e1:84:74:aa:25:e1:5b:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20a061392e5a4d0b0e9b0273e18474aa25e15b59/; sid:903201153; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"95:6f:15:c0:04:5f:84:c0:91:42:09:41:a5:b9:5d:be:e7:2e:4b:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/956f15c0045f84c091420941a5b95dbee72e4b6d/; sid:903201154; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"74:1f:79:25:49:9a:be:46:89:e6:1f:c0:68:1a:49:1e:48:c4:58:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/741f7925499abe4689e61fc0681a491e48c45815/; sid:903201155; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c8:f2:80:d0:12:f3:39:a9:92:09:2a:3c:ba:72:98:86:1f:7b:11:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8f280d012f339a992092a3cba7298861f7b1148/; sid:903201156; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"36:d0:b9:f7:c0:ce:f3:c2:7b:32:07:3d:cc:19:ba:07:67:94:e0:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/36d0b9f7c0cef3c27b32073dcc19ba076794e0ed/; sid:903201157; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:1e:76:ef:83:85:f7:f2:51:df:d7:86:e9:0d:d8:c4:98:2e:aa:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/371e76ef8385f7f251dfd786e90dd8c4982eaa82/; sid:903201158; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c9:22:41:7e:8c:bc:fe:6a:82:46:75:a8:e2:ed:e1:c8:e2:05:2a:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c922417e8cbcfe6a824675a8e2ede1c8e2052a8b/; sid:903201159; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1a:09:ee:00:f6:7b:01:70:d7:ab:13:8c:9b:a5:14:cf:7a:f5:50:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a09ee00f67b0170d7ab138c9ba514cf7af55085/; sid:903201160; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9b:71:13:0e:30:1e:d4:50:a8:bd:2a:ba:3a:7f:8c:eb:80:8c:b6:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9b71130e301ed450a8bd2aba3a7f8ceb808cb626/; sid:903201161; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d6:86:41:1c:69:9c:d8:42:00:4f:6b:d6:89:57:1f:1e:bb:c8:50:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d686411c699cd842004f6bd689571f1ebbc8501a/; sid:903201162; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a9:cd:c9:f7:4a:9d:66:9a:9f:51:10:95:c0:99:6a:c2:0f:9d:cf:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9cdc9f74a9d669a9f511095c0996ac20f9dcf7f/; sid:903201163; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"eb:95:20:fc:ba:10:66:dc:55:65:8b:c8:b1:bb:81:25:58:22:a6:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb9520fcba1066dc55658bc8b1bb81255822a605/; sid:903201164; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0a:b8:fc:10:ea:5a:42:fe:df:43:08:fe:70:fb:5f:8a:a3:cc:95:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ab8fc10ea5a42fedf4308fe70fb5f8aa3cc9577/; sid:903201165; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:7b:b4:7f:bc:e6:34:b6:22:97:8f:02:49:66:68:1c:7d:71:08:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/527bb47fbce634b622978f024966681c7d71082b/; sid:903201166; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:4e:79:c7:0b:f7:74:54:60:74:e0:f3:29:3f:ec:87:72:c1:b8:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e24e79c70bf774546074e0f3293fec8772c1b8a2/; sid:903201167; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"30:c1:39:e4:c9:47:0d:78:c5:29:c5:08:33:92:59:1b:f1:e6:f7:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30c139e4c9470d78c529c5083392591bf1e6f79d/; sid:903201168; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"24:10:a7:81:3a:2d:22:83:5c:72:d3:06:2c:a8:9a:b2:eb:d2:ec:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2410a7813a2d22835c72d3062ca89ab2ebd2ec48/; sid:903201169; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e6:04:80:1b:82:6d:b8:dc:01:84:3e:d2:bc:1c:71:43:74:66:63:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e604801b826db8dc01843ed2bc1c7143746663a4/; sid:903201170; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0d:ee:94:cc:a8:a8:5c:6b:6d:e1:6d:88:9b:90:58:4b:05:6c:ff:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dee94cca8a85c6b6de16d889b90584b056cff74/; sid:903201171; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"13:ff:7f:d5:3d:92:e1:85:65:72:14:a7:a4:7c:09:0e:26:f5:29:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/13ff7fd53d92e185657214a7a47c090e26f529d1/; sid:903201172; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5c:e4:2b:1e:73:a0:9f:7a:74:df:f8:e2:89:70:07:ad:8b:08:d9:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ce42b1e73a09f7a74dff8e2897007ad8b08d979/; sid:903201173; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"bf:45:52:7a:cf:51:83:9e:80:36:95:01:0d:c7:7e:ca:56:f2:cd:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf45527acf51839e803695010dc77eca56f2cda5/; sid:903201174; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1f:b7:63:39:b0:75:19:8c:34:d2:ee:2c:96:fb:55:d1:4d:f2:18:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fb76339b075198c34d2ee2c96fb55d14df218ba/; sid:903201175; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e7:b2:eb:15:5c:98:d1:e7:1c:a0:9d:68:8c:de:06:e7:9d:77:41:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7b2eb155c98d1e71ca09d688cde06e79d7741da/; sid:903201176; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"98:7c:f9:9d:2b:22:c0:51:1a:e9:2e:a5:34:dc:bb:3a:29:fb:5e:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/987cf99d2b22c0511ae92ea534dcbb3a29fb5eec/; sid:903201177; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"89:a1:3b:5a:9f:5e:95:f6:8a:7a:de:54:15:78:60:e9:f0:57:8e:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89a13b5a9f5e95f68a7ade54157860e9f0578e71/; sid:903201178; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"48:00:50:73:18:a6:dc:98:54:96:a5:46:3f:86:49:90:96:ab:10:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4800507318a6dc985496a5463f86499096ab10f3/; sid:903201179; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1a:44:fa:70:e5:6a:20:a4:54:b3:bf:72:cd:be:77:2e:53:8a:50:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a44fa70e56a20a454b3bf72cdbe772e538a50cd/; sid:903201180; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ad:f0:ae:94:a3:d1:ca:30:f0:cb:c2:3b:ff:fb:93:b5:d0:1c:6f:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/adf0ae94a3d1ca30f0cbc23bfffb93b5d01c6fda/; sid:903201181; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:5e:0f:5d:3c:53:53:c1:58:a8:26:2b:6e:cf:0c:9d:96:34:a6:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/155e0f5d3c5353c158a8262b6ecf0c9d9634a627/; sid:903201182; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:d1:aa:1a:b8:a1:43:92:04:40:41:a2:0a:d8:01:3f:20:7a:a1:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5dd1aa1ab8a14392044041a20ad8013f207aa18f/; sid:903201183; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ea:6b:22:f8:82:d4:88:6d:e4:4d:28:f9:7f:63:aa:80:e7:39:a4:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ea6b22f882d4886de44d28f97f63aa80e739a4fb/; sid:903201184; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"05:27:3e:6f:cf:79:d4:7b:38:41:d4:36:9b:1c:e3:04:1f:75:61:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/05273e6fcf79d47b3841d4369b1ce3041f756163/; sid:903201185; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4f:fb:ee:30:13:a4:64:df:8a:d3:42:3b:dc:0a:ad:40:b1:b1:12:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ffbee3013a464df8ad3423bdc0aad40b1b112f2/; sid:903201186; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1f:d0:8b:6d:c5:64:cb:35:5c:79:fa:05:19:29:0d:ad:5f:23:23:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fd08b6dc564cb355c79fa0519290dad5f23238d/; sid:903201187; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c8:3c:f2:2f:63:24:af:29:aa:62:2c:e1:a3:da:4e:b2:3a:f1:bd:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c83cf22f6324af29aa622ce1a3da4eb23af1bd2f/; sid:903201188; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e0:21:43:88:a7:94:38:3b:4e:41:fd:fa:ce:69:12:b3:32:b0:45:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e0214388a794383b4e41fdface6912b332b0457b/; sid:903201189; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"a3:93:d2:01:ba:27:f5:5b:3c:d9:86:15:1d:02:f8:68:15:97:60:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a393d201ba27f55b3cd986151d02f8681597602c/; sid:903201190; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"10:53:0d:c9:14:51:b4:77:50:17:c9:5f:dd:11:76:30:11:f9:50:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10530dc91451b4775017c95fdd11763011f95004/; sid:903201191; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7c:5b:e4:57:98:6a:c6:a7:d7:6d:20:a4:8f:38:fc:da:f4:86:3d:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c5be457986ac6a7d76d20a48f38fcdaf4863dab/; sid:903201192; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"7e:fc:b5:20:ca:d9:ac:92:6a:65:3d:4d:ba:a8:fa:ee:59:fa:f9:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7efcb520cad9ac926a653d4dbaa8faee59faf927/; sid:903201193; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"a0:4b:2e:a9:75:dd:4d:e3:be:aa:35:d0:8a:9c:60:9d:5b:47:15:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a04b2ea975dd4de3beaa35d08a9c609d5b4715a1/; sid:903201194; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"a9:65:0a:45:22:14:0d:42:e5:ca:45:29:da:54:80:56:25:ee:be:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9650a4522140d42e5ca4529da54805625eebe64/; sid:903201195; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b7:9a:fa:34:a7:e7:72:8d:48:bc:5a:bc:0e:e9:a6:43:b1:8f:44:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b79afa34a7e7728d48bc5abc0ee9a643b18f44ca/; sid:903201196; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"46:26:3f:94:5d:8e:c0:d2:d1:e2:cf:97:e9:08:3e:fa:b2:1c:d8:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46263f945d8ec0d2d1e2cf97e9083efab21cd81e/; sid:903201197; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f2:a1:18:7d:0e:02:b4:38:74:a9:4e:37:a6:36:4e:c5:cf:ea:d8:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f2a1187d0e02b43874a94e37a6364ec5cfead80a/; sid:903201198; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c6:33:21:c0:e7:20:ce:00:52:ab:08:cd:5c:39:3a:5d:e7:ca:ce:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c63321c0e720ce0052ab08cd5c393a5de7caceda/; sid:903201199; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5e:45:80:76:91:5a:38:20:06:c5:f2:2c:f6:d6:20:51:d8:ea:6e:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e458076915a382006c5f22cf6d62051d8ea6e7b/; sid:903201200; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"fa:c2:3c:75:88:97:f5:90:24:56:6a:fd:da:8d:9e:6c:98:bb:2d:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fac23c758897f59024566afdda8d9e6c98bb2d60/; sid:903201201; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2b:b8:ba:23:9c:86:93:cb:0f:48:d8:85:f2:12:eb:c3:00:a8:eb:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2bb8ba239c8693cb0f48d885f212ebc300a8eb56/; sid:903201202; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"76:8e:fe:87:e0:b9:5e:97:52:62:af:b3:5e:03:50:c5:fe:10:c8:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/768efe87e0b95e975262afb35e0350c5fe10c868/; sid:903201203; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"74:8a:29:1d:d8:3f:4a:e3:a1:e4:8d:35:20:f2:5d:7b:40:01:d9:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/748a291dd83f4ae3a1e48d3520f25d7b4001d928/; sid:903201204; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"13:5f:bc:73:c6:0d:e8:67:82:b0:50:78:b5:bc:44:3a:26:10:e9:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/135fbc73c60de86782b05078b5bc443a2610e95d/; sid:903201205; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6b:01:9f:cd:64:e1:e1:c8:a3:9e:03:be:07:46:08:f1:bc:df:25:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b019fcd64e1e1c8a39e03be074608f1bcdf253c/; sid:903201206; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c2:6e:2c:33:ff:f6:57:21:ed:de:a5:e6:32:ce:12:4e:9e:71:29:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c26e2c33fff65721eddea5e632ce124e9e7129b2/; sid:903201207; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"44:6e:cf:82:fa:1a:ec:7f:00:a0:47:ff:e2:4b:2b:59:7c:9a:c0:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/446ecf82fa1aec7f00a047ffe24b2b597c9ac08e/; sid:903201208; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"94:2a:32:30:34:a8:0e:06:70:d3:69:7b:6e:6e:1f:18:e3:74:55:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/942a323034a80e0670d3697b6e6e1f18e37455bc/; sid:903201209; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1b:72:dd:e6:90:11:e4:99:e5:ec:f4:01:e4:93:2b:b4:c5:cb:3f:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b72dde69011e499e5ecf401e4932bb4c5cb3f6e/; sid:903201210; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c3:f7:45:af:14:b0:fe:22:02:54:f3:72:60:0c:32:36:7a:d4:ea:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3f745af14b0fe220254f372600c32367ad4eab8/; sid:903201211; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"99:38:97:4f:71:d1:71:54:79:dc:6d:db:5b:58:31:1c:17:7a:f0:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9938974f71d1715479dc6ddb5b58311c177af08e/; sid:903201212; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"90:4b:f7:87:4a:d3:93:0f:e5:74:73:d0:0c:e8:53:8b:4a:4f:31:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/904bf7874ad3930fe57473d00ce8538b4a4f31a8/; sid:903201213; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"10:fe:db:94:7e:fc:90:06:06:23:b0:8d:a6:60:33:0c:4b:37:22:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10fedb947efc90060623b08da660330c4b3722f6/; sid:903201214; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1a:d2:cd:b4:58:67:cb:90:40:bf:20:ab:53:f2:88:c1:d5:29:a0:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ad2cdb45867cb9040bf20ab53f288c1d529a0ac/; sid:903201215; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6a:13:91:7d:aa:4e:c2:02:77:cb:50:9d:af:14:3d:15:f4:04:8d:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a13917daa4ec20277cb509daf143d15f4048d8f/; sid:903201216; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f6:8b:61:24:1b:49:e3:7c:f0:a1:75:47:ce:f7:42:f1:6a:59:5f:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f68b61241b49e37cf0a17547cef742f16a595fea/; sid:903201217; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cf:b7:bd:1b:08:66:19:a1:fa:1b:3b:68:b9:88:3a:3b:75:d0:10:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfb7bd1b086619a1fa1b3b68b9883a3b75d010b2/; sid:903201218; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b5:70:92:f7:ef:bb:48:a1:21:87:e7:a4:56:f1:b0:12:d2:07:18:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b57092f7efbb48a12187e7a456f1b012d207184f/; sid:903201219; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"49:48:cd:47:1f:d2:93:a9:2d:4f:b6:8d:87:0c:b0:be:54:5d:b9:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4948cd471fd293a92d4fb68d870cb0be545db926/; sid:903201220; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3c:9b:8d:e7:69:21:83:09:13:64:40:16:a9:3b:09:a6:7f:b0:d8:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c9b8de76921830913644016a93b09a67fb0d8f4/; sid:903201221; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:67:e9:a7:90:0f:42:74:92:cd:fe:09:a1:4d:bd:20:a5:2d:17:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce67e9a7900f427492cdfe09a14dbd20a52d1765/; sid:903201222; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"01:7b:f6:e2:7b:aa:42:95:f2:1d:e7:5c:af:20:96:16:d5:ee:77:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/017bf6e27baa4295f21de75caf209616d5ee779b/; sid:903201223; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"b2:0d:20:ac:3b:24:92:f1:1a:27:75:d8:00:fd:72:6e:14:fc:6f:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b20d20ac3b2492f11a2775d800fd726e14fc6fa6/; sid:903201224; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e7:ad:52:8a:97:a4:80:86:cc:d5:3a:37:bc:dd:91:d4:6d:fe:b2:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7ad528a97a48086ccd53a37bcdd91d46dfeb2d0/; sid:903201225; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"63:4b:da:13:1a:93:32:8a:e6:98:b6:28:e7:56:cc:a6:f5:69:61:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/634bda131a93328ae698b628e756cca6f56961d7/; sid:903201226; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"21:1e:0b:2e:2b:50:62:d3:6d:57:00:0f:00:68:b3:9b:3e:6f:ba:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/211e0b2e2b5062d36d57000f0068b39b3e6fba13/; sid:903201227; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:58:7b:07:c7:08:62:56:d8:cc:52:e3:c5:24:e7:91:28:90:b3:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a587b07c7086256d8cc52e3c524e7912890b359/; sid:903201228; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4d:97:3d:26:3e:f9:78:8a:cf:4e:bc:cf:bc:5a:fb:96:0e:25:a9:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d973d263ef9788acf4ebccfbc5afb960e25a903/; sid:903201229; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c9:0b:3c:d4:d5:17:db:4a:de:4f:65:bb:e3:5b:0e:1d:a1:51:85:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c90b3cd4d517db4ade4f65bbe35b0e1da151856a/; sid:903201230; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d7:8d:84:73:60:95:b5:1c:91:4c:63:ab:a8:06:51:c4:b2:8b:d8:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d78d84736095b51c914c63aba80651c4b28bd8b0/; sid:903201231; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8f:af:a9:9c:73:14:e9:eb:3c:64:26:9f:dc:f3:42:b6:17:5b:01:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8fafa99c7314e9eb3c64269fdcf342b6175b019e/; sid:903201232; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5c:55:d2:f5:1c:af:87:1c:95:6a:13:7b:f6:1c:47:4a:14:be:a8:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c55d2f51caf871c956a137bf61c474a14bea854/; sid:903201233; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ad:81:03:b5:e6:15:06:60:ed:b3:17:ad:69:a9:3e:80:37:0b:a9:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ad8103b5e6150660edb317ad69a93e80370ba9c9/; sid:903201234; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"36:d2:86:99:e1:6b:62:96:61:e4:30:f8:88:c7:a7:c3:05:48:4e:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/36d28699e16b629661e430f888c7a7c305484e4a/; sid:903201235; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fd:97:51:4a:5f:2b:bd:20:05:2a:52:27:07:d1:cf:d4:c4:05:0f:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd97514a5f2bbd20052a522707d1cfd4c4050feb/; sid:903201236; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"46:5b:e3:dd:ee:3c:51:4e:51:ae:98:77:ba:54:d1:65:22:d9:ae:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/465be3ddee3c514e51ae9877ba54d16522d9ae8c/; sid:903201237; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dd:7e:3c:fb:31:2e:f1:b2:0d:61:08:b9:e2:fb:d5:45:1b:99:71:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd7e3cfb312ef1b20d6108b9e2fbd5451b997157/; sid:903201238; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"16:85:ba:03:51:56:50:a1:c2:a1:33:8b:f9:42:1e:a0:0a:7c:03:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1685ba03515650a1c2a1338bf9421ea00a7c0362/; sid:903201239; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5c:d7:39:98:6a:d9:cf:12:8d:4b:ad:03:17:dc:d0:ab:81:c2:cf:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5cd739986ad9cf128d4bad0317dcd0ab81c2cf2b/; sid:903201240; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f2:a8:3f:92:7a:ed:31:c0:bc:38:48:84:f9:32:ea:4a:a9:6b:21:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f2a83f927aed31c0bc384884f932ea4aa96b2182/; sid:903201241; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7e:62:5c:53:31:bc:09:5a:2a:09:d7:39:f0:1d:ee:d7:b8:2e:ec:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e625c5331bc095a2a09d739f01deed7b82eec4a/; sid:903201242; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"45:e3:f9:5f:3b:01:ca:79:81:ce:44:f4:15:39:6b:5d:53:ea:2f:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/45e3f95f3b01ca7981ce44f415396b5d53ea2f37/; sid:903201243; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"73:b2:5a:f5:8c:1f:fc:52:19:0c:62:d3:b6:0e:3a:88:d7:eb:ea:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73b25af58c1ffc52190c62d3b60e3a88d7ebea24/; sid:903201244; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3c:0f:57:09:3d:80:0d:e7:5f:32:a1:ee:a5:54:e7:5e:3a:ea:de:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c0f57093d800de75f32a1eea554e75e3aeadeec/; sid:903201245; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"94:42:bb:9e:31:81:5f:e7:8e:f8:9a:45:61:75:82:c3:50:22:eb:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9442bb9e31815fe78ef89a45617582c35022eb13/; sid:903201246; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d8:b1:2e:83:59:5f:43:99:6c:83:1d:7c:00:0b:f4:cb:9b:a9:e5:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8b12e83595f43996c831d7c000bf4cb9ba9e51a/; sid:903201247; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"2f:c9:af:d5:d4:fb:22:ea:31:25:84:24:c2:44:4a:f7:c7:a0:11:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2fc9afd5d4fb22ea31258424c2444af7c7a01139/; sid:903201248; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e3:bd:aa:15:f6:c6:31:39:c2:8e:57:fa:5a:32:89:19:0d:ac:0a:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e3bdaa15f6c63139c28e57fa5a3289190dac0a12/; sid:903201249; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d9:ea:8c:49:ad:85:60:e1:91:e2:42:de:5e:bd:49:b0:d6:c0:c1:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9ea8c49ad8560e191e242de5ebd49b0d6c0c180/; sid:903201250; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:fc:02:72:94:23:5c:86:25:cd:1a:ca:79:48:32:8c:1e:85:32:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e2fc027294235c8625cd1aca7948328c1e85325c/; sid:903201251; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f8:90:d6:bc:87:90:a2:9f:91:3c:b4:b6:a9:30:37:0c:38:08:9a:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f890d6bc8790a29f913cb4b6a930370c38089a25/; sid:903201252; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8b:35:6c:2a:7c:08:57:04:c5:99:59:ba:06:db:d0:17:1f:74:fb:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b356c2a7c085704c59959ba06dbd0171f74fbd5/; sid:903201253; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"27:24:0e:97:4a:bb:90:57:0d:76:3a:d5:31:76:8d:35:54:5a:36:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27240e974abb90570d763ad531768d35545a36fd/; sid:903201254; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"99:3d:a5:48:6c:11:06:2f:3b:3a:1f:19:36:fa:24:16:51:3d:8c:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/993da5486c11062f3b3a1f1936fa2416513d8c4a/; sid:903201255; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"87:86:45:d2:ae:90:20:67:e8:a8:09:60:60:e9:d2:75:93:cd:a7:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/878645d2ae902067e8a8096060e9d27593cda7c4/; sid:903201256; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"15:84:6b:fb:b4:3e:5b:57:6d:d3:f3:f6:27:5c:eb:73:1d:99:26:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15846bfbb43e5b576dd3f3f6275ceb731d9926bc/; sid:903201257; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2f:fd:d8:8a:84:9a:80:1c:96:a4:65:70:44:7f:7a:6b:9c:56:23:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2ffdd88a849a801c96a46570447f7a6b9c562346/; sid:903201258; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5c:b2:5a:c5:4c:e0:40:e1:24:c4:52:3d:ca:fc:c2:68:64:aa:92:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5cb25ac54ce040e124c4523dcafcc26864aa9277/; sid:903201259; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"7f:cd:2c:56:08:47:7d:34:c2:a3:9e:0a:74:3a:20:52:dc:de:94:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7fcd2c5608477d34c2a39e0a743a2052dcde94d1/; sid:903201260; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"24:67:d1:8c:4d:1a:74:9b:0e:0c:03:17:7b:22:59:66:00:0a:ce:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2467d18c4d1a749b0e0c03177b225966000aced9/; sid:903201261; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"de:64:20:f6:91:74:9b:27:5d:ee:88:46:9a:08:82:09:35:9c:ef:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de6420f691749b275dee88469a088209359cef29/; sid:903201262; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"29:73:49:4a:8c:67:7e:0e:7b:23:7b:8e:1a:92:fd:73:db:3f:93:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2973494a8c677e0e7b237b8e1a92fd73db3f9394/; sid:903201263; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"22:99:80:d6:20:53:47:0e:aa:cd:87:3e:c6:c5:03:ba:54:4e:03:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/229980d62053470eaacd873ec6c503ba544e03a5/; sid:903201264; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f3:a3:b0:16:11:12:b3:41:fb:e6:b3:e0:f7:85:ec:cd:76:c3:5e:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f3a3b0161112b341fbe6b3e0f785eccd76c35e19/; sid:903201265; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d7:9b:48:61:80:8a:f8:f3:a9:af:8b:35:a8:9d:0d:47:24:55:bd:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d79b4861808af8f3a9af8b35a89d0d472455bd41/; sid:903201266; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"19:8b:e3:e1:19:89:34:fe:ec:57:d1:10:ff:36:cf:79:05:dc:de:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/198be3e1198934feec57d110ff36cf7905dcde8b/; sid:903201267; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"96:fc:9c:af:a6:7f:a6:61:6c:88:17:60:fc:ab:36:d2:27:be:bd:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/96fc9cafa67fa6616c881760fcab36d227bebd2c/; sid:903201268; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shylock C&C)"; tls_cert_fingerprint; content:"b1:1e:5d:b4:da:0a:1e:b4:19:ec:3d:14:44:3b:10:61:6d:aa:02:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b11e5db4da0a1eb419ec3d14443b10616daa0233/; sid:903201269; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"4e:6a:4b:49:76:81:b4:c0:9e:2b:f4:4c:65:6f:a4:b8:c3:76:aa:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e6a4b497681b4c09e2bf44c656fa4b8c376aa37/; sid:903201270; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:8f:e7:6f:ee:e3:44:16:52:5f:8b:e5:d5:0f:aa:5d:58:5b:13:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a8fe76feee34416525f8be5d50faa5d585b13cf/; sid:903201271; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:da:69:17:83:c1:66:f7:50:bb:bf:34:0d:63:71:69:a9:e8:d6:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ada691783c166f750bbbf340d637169a9e8d6f9/; sid:903201272; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"46:ff:ef:69:7f:40:21:09:36:60:58:6d:bd:fc:00:87:a0:48:95:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46ffef697f4021093660586dbdfc0087a0489571/; sid:903201273; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5d:88:2b:e7:32:98:26:77:ba:3e:57:e9:dc:95:ae:77:d0:39:ab:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d882be732982677ba3e57e9dc95ae77d039abcc/; sid:903201274; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ab:d3:4c:09:da:5f:04:3d:82:11:2f:9e:b2:86:79:2e:47:43:ed:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/abd34c09da5f043d82112f9eb286792e4743ed39/; sid:903201275; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d4:a6:63:6b:43:f8:96:af:c5:03:eb:97:6a:66:2d:23:7e:06:fa:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4a6636b43f896afc503eb976a662d237e06fa9e/; sid:903201276; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"95:61:05:c5:cb:1e:4a:33:94:6d:29:97:d9:f7:e4:07:ae:13:df:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/956105c5cb1e4a33946d2997d9f7e407ae13dfa0/; sid:903201277; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6d:32:5b:fa:a6:b6:e1:9b:ca:22:8d:73:bb:0a:d4:41:61:9f:d1:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d325bfaa6b6e19bca228d73bb0ad441619fd1a0/; sid:903201278; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"4a:48:de:cf:eb:6a:4a:ea:44:10:a7:7a:d3:08:f1:b0:10:8c:ea:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a48decfeb6a4aea4410a77ad308f1b0108ceaa5/; sid:903201279; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"08:6f:65:08:9d:7e:24:63:aa:60:ab:71:93:4f:e0:4c:4c:9d:7c:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/086f65089d7e2463aa60ab71934fe04c4c9d7cc6/; sid:903201280; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"44:7f:91:67:6e:92:66:5a:a0:4b:08:cc:12:29:ca:65:d0:54:47:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/447f91676e92665aa04b08cc1229ca65d0544744/; sid:903201281; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"76:f3:a4:6e:e4:ef:a9:be:c5:ea:a1:44:0f:ee:7c:b7:4c:24:fd:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/76f3a46ee4efa9bec5eaa1440fee7cb74c24fd25/; sid:903201282; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"43:b2:09:1b:b1:cc:23:b0:0e:1c:b2:32:d6:8f:a3:03:8a:a1:07:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43b2091bb1cc23b00e1cb232d68fa3038aa10792/; sid:903201283; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"4d:b1:ba:4e:f3:ca:53:dd:88:df:a0:94:20:a0:76:91:2b:d5:b9:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4db1ba4ef3ca53dd88dfa09420a076912bd5b956/; sid:903201284; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"c4:2d:2a:84:cb:f7:9b:6c:09:1f:01:e3:38:e5:14:11:2c:2b:fa:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c42d2a84cbf79b6c091f01e338e514112c2bfa0b/; sid:903201285; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f9:5b:24:25:00:03:78:4f:2a:95:97:fc:8e:82:ad:d3:ed:25:cf:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f95b24250003784f2a9597fc8e82add3ed25cf2e/; sid:903201286; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"c4:cc:25:a2:88:92:56:b8:ec:a1:6d:4c:34:42:17:5d:c1:84:cd:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4cc25a2889256b8eca16d4c3442175dc184cd43/; sid:903201287; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e3:32:d7:32:74:34:ac:d5:68:1a:de:b8:24:2d:f3:f9:e2:82:9b:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e332d7327434acd5681adeb8242df3f9e2829bbf/; sid:903201288; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f1:01:a8:c2:df:f8:93:62:78:7a:05:38:1d:96:d1:30:eb:c0:22:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f101a8c2dff89362787a05381d96d130ebc02242/; sid:903201289; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"20:f9:b3:06:c1:84:0a:ec:ba:b9:17:e3:4d:6c:dc:a1:d7:78:73:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20f9b306c1840aecbab917e34d6cdca1d778730f/; sid:903201290; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"68:18:c8:a5:16:8e:b2:0f:0c:39:7d:2e:71:7f:53:ae:06:5a:bd:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6818c8a5168eb20f0c397d2e717f53ae065abd38/; sid:903201291; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"22:99:18:d6:5d:7b:b2:18:6e:cf:b9:e8:6a:25:c4:65:5a:a9:1b:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/229918d65d7bb2186ecfb9e86a25c4655aa91bda/; sid:903201292; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d2:18:6c:23:5f:70:b7:fe:fb:cf:c4:d9:db:83:f3:72:48:0d:57:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2186c235f70b7fefbcfc4d9db83f372480d57b7/; sid:903201293; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"db:ca:34:41:a2:04:7f:58:f2:f4:f2:49:30:16:a1:cb:97:b7:3e:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbca3441a2047f58f2f4f2493016a1cb97b73e6c/; sid:903201294; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f9:aa:3c:a3:b2:ab:fc:70:8b:53:50:1d:4f:98:6b:64:25:7b:e1:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f9aa3ca3b2abfc708b53501d4f986b64257be1e2/; sid:903201295; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3a:a5:03:9f:af:5c:c5:fe:6d:47:02:3c:6f:01:9b:23:f8:80:31:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3aa5039faf5cc5fe6d47023c6f019b23f880311b/; sid:903201296; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"29:6e:ba:e2:d8:57:7f:07:86:17:ad:01:d6:aa:a4:c0:dc:b9:a5:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/296ebae2d8577f078617ad01d6aaa4c0dcb9a55a/; sid:903201297; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4b:d1:0c:59:4b:1f:75:b6:af:86:e9:93:83:fe:07:7e:4b:14:d2:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4bd10c594b1f75b6af86e99383fe077e4b14d296/; sid:903201298; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:dd:2a:78:3d:f0:77:06:8f:b0:6b:81:9f:fb:1e:0a:42:e9:98:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77dd2a783df077068fb06b819ffb1e0a42e9988e/; sid:903201299; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"aa:4d:98:0d:9e:2b:3c:e6:d6:b1:b6:36:f6:1e:78:e5:9e:1d:20:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa4d980d9e2b3ce6d6b1b636f61e78e59e1d205d/; sid:903201300; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"cd:3b:43:da:61:4f:64:31:9b:ba:b8:71:b5:e9:ba:da:c2:65:f9:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd3b43da614f64319bbab871b5e9badac265f9a6/; sid:903201301; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b7:46:92:1e:21:4a:79:b7:a3:70:64:8a:4b:47:d7:5a:82:f1:a2:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b746921e214a79b7a370648a4b47d75a82f1a24c/; sid:903201302; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"55:0c:e6:33:bb:6d:c4:d5:72:f1:d5:2b:91:80:12:c2:66:fd:d7:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/550ce633bb6dc4d572f1d52b918012c266fdd718/; sid:903201303; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4e:9f:67:44:a0:2c:56:13:de:d8:27:bf:cd:91:e5:a1:77:58:18:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e9f6744a02c5613ded827bfcd91e5a1775818e5/; sid:903201304; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c1:ce:35:ab:00:51:71:c2:46:ed:ed:e1:d3:d0:6a:1b:e0:25:4e:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1ce35ab005171c246edede1d3d06a1be0254ee1/; sid:903201305; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b0:20:18:45:52:13:7b:fe:20:69:b1:bc:64:32:43:5a:a5:23:68:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b020184552137bfe2069b1bc6432435aa523687f/; sid:903201306; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"aa:42:73:3a:1a:af:65:d4:f7:73:25:fd:2b:2d:09:04:df:04:61:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa42733a1aaf65d4f77325fd2b2d0904df0461d2/; sid:903201307; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"76:2e:04:c8:cb:4d:0f:4c:ac:c8:22:02:8e:7a:84:73:c2:7f:1f:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/762e04c8cb4d0f4cacc822028e7a8473c27f1f50/; sid:903201308; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a6:ba:8f:3e:18:63:b3:95:ec:75:2a:6f:55:ac:61:08:4a:3b:09:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6ba8f3e1863b395ec752a6f55ac61084a3b09e7/; sid:903201309; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a2:45:97:12:4a:58:4a:d4:5c:7e:d8:55:62:fe:9a:40:af:00:8d:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a24597124a584ad45c7ed85562fe9a40af008dd0/; sid:903201310; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dc:f0:f5:d0:59:d5:55:44:14:f1:dc:1a:80:9d:e7:8e:70:18:02:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dcf0f5d059d5554414f1dc1a809de78e7018024a/; sid:903201311; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"73:74:3f:8e:80:db:8d:d4:20:9e:a9:d0:ce:c7:1e:43:58:48:58:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73743f8e80db8dd4209ea9d0cec71e43584858e5/; sid:903201312; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d0:34:02:17:c2:96:82:45:ee:46:d0:99:77:94:b7:09:12:f2:c5:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0340217c2968245ee46d0997794b70912f2c51a/; sid:903201313; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"35:77:58:7d:f9:2f:9c:5f:df:df:74:92:af:f3:1b:4a:58:9a:f0:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3577587df92f9c5fdfdf7492aff31b4a589af02c/; sid:903201314; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a2:ca:09:f4:83:94:af:e0:e7:8a:23:b5:b4:cf:c8:9a:b7:38:46:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a2ca09f48394afe0e78a23b5b4cfc89ab738460c/; sid:903201315; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"69:fd:f0:ee:a2:40:52:98:66:78:d0:e8:49:de:27:92:05:b1:be:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69fdf0eea24052986678d0e849de279205b1beb6/; sid:903201316; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"99:d7:6b:c2:ab:d3:34:b3:83:16:7e:df:35:dc:e1:1f:22:41:aa:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99d76bc2abd334b383167edf35dce11f2241aae4/; sid:903201317; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a2:75:76:84:61:b0:ac:e4:a3:5e:3a:5f:93:10:43:76:83:c0:08:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a275768461b0ace4a35e3a5f9310437683c0087b/; sid:903201318; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f7:27:dc:37:c0:a7:d9:e3:87:d0:5f:85:34:01:70:46:e7:2e:be:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f727dc37c0a7d9e387d05f8534017046e72ebe72/; sid:903201319; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e6:eb:19:b9:6e:1c:dd:3a:5f:aa:f1:db:ca:3b:cb:c6:ba:57:3e:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e6eb19b96e1cdd3a5faaf1dbca3bcbc6ba573e34/; sid:903201320; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b3:6c:ff:6d:8f:c6:2b:06:a5:45:e6:98:50:57:32:c1:e7:04:45:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b36cff6d8fc62b06a545e698505732c1e70445bc/; sid:903201321; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a5:74:e4:f9:9b:fc:08:aa:3b:d3:2f:0e:b7:71:43:95:2a:77:0a:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a574e4f99bfc08aa3bd32f0eb77143952a770ab9/; sid:903201322; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"23:7c:75:e1:50:31:a9:ee:64:26:d9:36:c1:f0:76:41:fa:8b:fe:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/237c75e15031a9ee6426d936c1f07641fa8bfe83/; sid:903201323; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"28:48:8d:78:8e:a4:78:3b:04:bf:ec:c2:47:ad:54:40:23:f8:1e:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28488d788ea4783b04bfecc247ad544023f81e84/; sid:903201324; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"8b:97:ff:88:64:d4:9f:70:29:57:ba:87:b4:56:45:2e:44:27:85:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b97ff8864d49f702957ba87b456452e44278556/; sid:903201325; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8d:f0:d5:16:5b:66:59:15:97:e7:ac:68:89:30:91:32:a0:6b:1a:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8df0d5165b66591597e7ac6889309132a06b1a21/; sid:903201326; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"07:39:aa:cd:13:14:0b:b3:a1:41:da:80:57:8f:4e:46:ec:f3:16:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0739aacd13140bb3a141da80578f4e46ecf31689/; sid:903201327; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ca:5e:b0:93:0d:ac:1a:7b:b0:d2:05:8c:eb:b3:13:3b:d0:11:02:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca5eb0930dac1a7bb0d2058cebb3133bd0110244/; sid:903201328; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"08:18:62:7a:01:ed:9e:09:5e:77:9d:0b:1a:26:fc:df:b2:6b:a5:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0818627a01ed9e095e779d0b1a26fcdfb26ba56d/; sid:903201329; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"43:84:dd:02:68:c5:b7:a6:0b:ae:8a:51:64:f7:37:e3:11:b1:bd:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4384dd0268c5b7a60bae8a5164f737e311b1bddb/; sid:903201330; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"32:fa:c3:7a:39:3d:6f:dc:d2:a2:f1:b9:78:91:7b:71:30:70:3f:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32fac37a393d6fdcd2a2f1b978917b7130703f59/; sid:903201331; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1e:65:53:ad:8b:b9:84:de:0f:a0:68:e4:d4:2c:03:74:2a:43:29:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e6553ad8bb984de0fa068e4d42c03742a4329c7/; sid:903201332; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"2c:dd:a5:39:04:71:2f:a2:fd:15:c3:48:26:cd:05:f2:7c:94:f9:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2cdda53904712fa2fd15c34826cd05f27c94f967/; sid:903201333; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"31:16:2c:d4:5c:41:ab:8e:b5:e7:e3:63:08:08:bd:1e:4e:24:25:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31162cd45c41ab8eb5e7e3630808bd1e4e2425ee/; sid:903201334; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"92:4c:a1:d6:8c:e0:8d:3c:b4:e5:dc:fd:8a:9b:13:80:8d:57:bc:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/924ca1d68ce08d3cb4e5dcfd8a9b13808d57bcaf/; sid:903201335; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"03:3c:fe:41:ee:16:7a:a3:1b:8a:f8:98:b0:33:f6:bf:ec:5c:c9:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/033cfe41ee167aa31b8af898b033f6bfec5cc9d2/; sid:903201336; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7b:de:44:76:d1:8e:87:83:7c:15:08:cf:57:af:f9:42:9f:17:b7:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7bde4476d18e87837c1508cf57aff9429f17b7b0/; sid:903201337; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"56:95:62:9c:53:90:72:e3:33:95:ea:2c:b3:81:c9:7e:db:1c:cf:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5695629c539072e33395ea2cb381c97edb1ccf7a/; sid:903201338; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"06:1e:5f:80:c1:a8:66:a3:b3:88:74:ff:84:78:f6:bb:ec:99:c9:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/061e5f80c1a866a3b38874ff8478f6bbec99c9a6/; sid:903201339; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"be:50:d6:86:13:53:bf:62:7a:02:82:5e:6d:b1:19:55:ba:a6:23:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be50d6861353bf627a02825e6db11955baa62398/; sid:903201340; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"66:fb:92:5c:f7:8d:e7:1c:e1:85:1e:4b:69:c7:c0:7b:3d:6d:9a:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66fb925cf78de71ce1851e4b69c7c07b3d6d9a48/; sid:903201341; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ba:0b:4e:be:6f:07:d2:f3:4f:98:d2:c6:02:18:8a:9d:1c:d8:a7:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba0b4ebe6f07d2f34f98d2c602188a9d1cd8a709/; sid:903201342; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"64:b9:6d:98:11:b9:f9:ae:73:5c:5f:78:75:8d:9a:7b:37:80:b9:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64b96d9811b9f9ae735c5f78758d9a7b3780b989/; sid:903201343; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5c:04:8b:96:c2:22:ca:b6:20:63:a7:37:13:8d:f0:49:e7:08:42:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c048b96c222cab62063a737138df049e70842ef/; sid:903201344; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1c:ee:c6:bd:f4:d5:87:38:3d:8c:66:ff:60:6f:84:d8:bf:51:90:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ceec6bdf4d587383d8c66ff606f84d8bf5190f9/; sid:903201345; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d4:d7:9d:24:88:10:61:99:fa:0f:89:cf:9f:4d:eb:fe:32:d7:c8:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4d79d2488106199fa0f89cf9f4debfe32d7c81b/; sid:903201346; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"29:73:53:4e:d6:89:21:f2:32:42:b0:35:83:e1:ff:ad:e1:f2:03:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2973534ed68921f23242b03583e1ffade1f2039f/; sid:903201347; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f1:30:00:e5:23:67:db:c2:82:19:02:5e:c5:e0:55:c3:35:0a:49:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f13000e52367dbc28219025ec5e055c3350a4961/; sid:903201348; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bf:d9:a5:b9:cc:08:ab:5d:bf:5a:5d:7a:6b:64:aa:23:5f:ba:51:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bfd9a5b9cc08ab5dbf5a5d7a6b64aa235fba51f9/; sid:903201349; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"da:c8:43:9f:e1:00:09:8d:b0:4e:96:26:a1:77:4b:30:63:94:ce:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dac8439fe100098db04e9626a1774b306394cec6/; sid:903201350; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"45:f8:08:17:d0:11:66:4f:23:3d:b3:35:49:40:e0:80:12:88:6d:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/45f80817d011664f233db3354940e08012886d17/; sid:903201351; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"96:a2:d4:41:b2:3a:8c:26:34:8f:4f:68:c2:b2:6b:f4:9d:59:e9:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/96a2d441b23a8c26348f4f68c2b26bf49d59e94f/; sid:903201352; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"03:a0:ac:10:93:3f:bf:84:4a:72:28:08:39:69:b1:a0:dc:ba:d7:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/03a0ac10933fbf844a7228083969b1a0dcbad740/; sid:903201353; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c1:b1:77:74:c1:6c:d6:17:9a:6c:49:d1:f5:b6:f1:7a:2b:08:e3:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1b17774c16cd6179a6c49d1f5b6f17a2b08e3ed/; sid:903201354; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"bc:3e:59:0d:11:8d:fb:46:90:99:9a:47:33:e5:bf:f5:34:51:d1:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc3e590d118dfb4690999a4733e5bff53451d123/; sid:903201355; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"90:21:32:c3:2d:01:e0:ee:d9:20:7a:ad:ff:a4:01:7b:46:9a:d9:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/902132c32d01e0eed9207aadffa4017b469ad9e8/; sid:903201356; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"41:29:5a:7e:73:ea:49:c1:25:41:96:b2:f2:a7:bf:4e:94:59:60:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/41295a7e73ea49c1254196b2f2a7bf4e9459600e/; sid:903201357; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b8:22:cb:45:a2:e4:e8:42:2a:84:5f:d9:5f:c9:9d:5b:12:b7:b8:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b822cb45a2e4e8422a845fd95fc99d5b12b7b87c/; sid:903201358; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"06:d2:ca:ce:ee:c3:ce:bf:40:18:9a:27:f7:90:69:bc:da:28:ea:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06d2caceeec3cebf40189a27f79069bcda28ea2b/; sid:903201359; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8a:00:e9:7c:2e:6a:ef:c6:1e:b3:c0:59:b6:1c:e2:64:4d:31:de:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a00e97c2e6aefc61eb3c059b61ce2644d31de58/; sid:903201360; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"67:09:e7:52:fd:6e:05:bc:d4:44:a8:4f:46:94:c7:d3:08:9e:97:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6709e752fd6e05bcd444a84f4694c7d3089e97f3/; sid:903201361; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4a:7b:de:af:42:84:06:ba:ba:73:d7:25:17:1b:a6:aa:07:07:92:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a7bdeaf428406baba73d725171ba6aa070792d8/; sid:903201362; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5e:0b:97:df:7b:a7:96:31:01:0d:c6:bd:10:59:b8:fb:fb:65:1e:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e0b97df7ba79631010dc6bd1059b8fbfb651ed1/; sid:903201363; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"44:d2:18:a8:76:02:f6:5f:9e:00:21:a1:ad:1e:95:18:9b:e8:aa:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44d218a87602f65f9e0021a1ad1e95189be8aaaf/; sid:903201364; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ab:63:1d:10:a2:95:27:79:5c:17:1a:da:34:a3:a7:31:07:eb:cf:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab631d10a29527795c171ada34a3a73107ebcfbd/; sid:903201365; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f4:ba:5e:19:1d:9e:31:29:02:c7:b4:9d:08:5c:b1:1f:a1:6a:96:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4ba5e191d9e312902c7b49d085cb11fa16a961f/; sid:903201366; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"20:42:59:23:8e:df:44:37:22:a5:94:d3:bb:06:b6:4a:71:f0:20:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/204259238edf443722a594d3bb06b64a71f0207c/; sid:903201367; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ce:6c:46:61:f7:04:3d:bf:0f:9a:f5:b8:b5:ff:0a:8e:dd:74:35:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce6c4661f7043dbf0f9af5b8b5ff0a8edd743555/; sid:903201368; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"53:c8:88:1e:8e:a0:0a:a1:27:0e:23:32:2b:40:3f:86:57:e0:28:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53c8881e8ea00aa1270e23322b403f8657e028dc/; sid:903201369; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"23:ef:58:39:e1:41:48:d0:75:4b:27:a3:74:cf:fc:83:2f:5a:e4:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/23ef5839e14148d0754b27a374cffc832f5ae473/; sid:903201370; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"87:4f:42:08:c8:eb:91:d8:a2:f5:d2:f1:55:e9:41:38:d9:69:b2:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/874f4208c8eb91d8a2f5d2f155e94138d969b2f6/; sid:903201371; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:a5:23:f9:52:3f:bf:d9:8f:eb:3e:d0:62:b5:0f:05:8f:8b:df:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37a523f9523fbfd98feb3ed062b50f058f8bdff2/; sid:903201372; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0b:6d:45:67:07:c8:d5:75:da:52:3f:b8:2a:11:9f:a9:4b:1d:d6:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b6d456707c8d575da523fb82a119fa94b1dd64e/; sid:903201373; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f1:f2:5b:dc:25:e6:24:7a:9a:53:04:8c:73:9a:cd:a6:0d:75:06:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f1f25bdc25e6247a9a53048c739acda60d750653/; sid:903201374; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8b:00:d3:78:7a:5b:c6:59:9d:6c:de:f4:54:4f:2c:cd:ad:d1:2d:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b00d3787a5bc6599d6cdef4544f2ccdadd12dc2/; sid:903201375; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1c:ac:ed:b7:c2:51:5f:12:d8:23:3e:37:c6:78:a7:22:55:52:e7:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1cacedb7c2515f12d8233e37c678a7225552e7b0/; sid:903201376; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"44:de:8f:4b:d7:8b:b4:ff:83:37:02:86:de:5e:4c:0d:ef:fb:81:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44de8f4bd78bb4ff83370286de5e4c0deffb8195/; sid:903201377; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"04:08:4d:04:ae:e0:7d:52:d6:a8:36:78:94:fe:f3:24:0f:c4:9e:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/04084d04aee07d52d6a8367894fef3240fc49e63/; sid:903201378; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"21:2c:93:da:89:61:b8:8f:a9:35:58:2c:58:36:ba:d8:06:3d:96:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/212c93da8961b88fa935582c5836bad8063d9624/; sid:903201379; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6f:22:7b:05:e3:2d:37:c2:d5:9d:46:5d:d1:8c:70:79:5c:0a:b3:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f227b05e32d37c2d59d465dd18c70795c0ab356/; sid:903201380; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"46:33:e1:0a:a7:63:b9:f9:60:f6:9c:ed:c6:3d:6a:b1:8b:3f:23:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4633e10aa763b9f960f69cedc63d6ab18b3f2380/; sid:903201381; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"17:dd:98:22:d9:3b:d0:1d:91:e9:9a:42:a3:02:70:a3:05:17:e8:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17dd9822d93bd01d91e99a42a30270a30517e82d/; sid:903201382; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"6c:0d:0d:b6:d2:d3:1a:b9:b6:e2:7b:00:76:9c:fb:b9:e5:2a:48:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6c0d0db6d2d31ab9b6e27b00769cfbb9e52a484e/; sid:903201383; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e1:cd:4a:73:06:fb:0f:5e:ad:f6:ca:a7:11:62:55:94:23:ea:45:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1cd4a7306fb0f5eadf6caa71162559423ea45fe/; sid:903201384; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"9a:0d:73:d7:dd:55:8c:d3:de:78:53:58:6d:4a:d0:6c:21:80:35:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a0d73d7dd558cd3de7853586d4ad06c21803500/; sid:903201385; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"3f:7e:87:75:19:d5:ff:64:52:0c:d2:96:09:5e:a0:9a:bb:09:0f:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3f7e877519d5ff64520cd296095ea09abb090f45/; sid:903201386; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"2a:ea:63:09:58:d5:38:71:e9:b2:04:30:f8:7f:55:5b:c5:4c:76:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2aea630958d53871e9b20430f87f555bc54c763e/; sid:903201387; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"50:e7:63:a9:40:d0:95:71:0e:09:c0:7e:db:0f:12:69:24:26:a0:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50e763a940d095710e09c07edb0f12692426a0c6/; sid:903201388; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7e:46:0f:1c:30:c6:84:34:2f:b8:f9:6e:45:47:f6:7b:1d:3a:ee:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e460f1c30c684342fb8f96e4547f67b1d3aee9e/; sid:903201389; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"f5:fd:20:8c:44:a7:40:33:67:bc:23:15:4b:7d:82:9e:11:fa:47:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5fd208c44a7403367bc23154b7d829e11fa47de/; sid:903201390; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c8:c7:68:be:d2:57:32:85:25:7e:b4:09:27:9c:f3:d7:39:3a:8a:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8c768bed2573285257eb409279cf3d7393a8a51/; sid:903201391; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:50:cb:64:7f:6b:d0:c0:cf:71:2c:55:f1:a6:6f:af:1e:3c:c6:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e250cb647f6bd0c0cf712c55f1a66faf1e3cc630/; sid:903201392; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1a:f0:89:69:77:20:70:47:01:5f:85:b6:a3:63:53:62:d0:2b:81:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1af0896977207047015f85b6a3635362d02b8146/; sid:903201393; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"11:10:07:c2:ca:c6:24:10:61:07:5c:68:34:a7:9e:bd:1a:e5:a4:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/111007c2cac6241061075c6834a79ebd1ae5a4cb/; sid:903201394; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ce:8c:bf:ff:a1:97:75:40:07:ef:65:7a:51:a2:f4:03:9f:ac:5f:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce8cbfffa197754007ef657a51a2f4039fac5f03/; sid:903201395; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"6b:71:30:22:9d:fb:db:cf:38:e5:72:51:53:a9:cd:96:f0:03:2a:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b7130229dfbdbcf38e5725153a9cd96f0032ae2/; sid:903201396; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"26:dd:0e:9d:98:67:93:4f:75:b2:5e:25:dd:02:88:19:95:b4:be:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26dd0e9d9867934f75b25e25dd02881995b4be42/; sid:903201397; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"98:29:3f:f5:b0:05:d9:f9:a7:39:9f:e4:16:72:d1:21:70:92:70:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/98293ff5b005d9f9a7399fe41672d121709270bb/; sid:903201398; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f4:b6:20:23:25:10:3d:6b:2d:ad:f0:b8:0f:03:0c:05:b5:93:60:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4b6202325103d6b2dadf0b80f030c05b5936052/; sid:903201399; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"15:76:1e:8a:78:18:9f:6c:05:0d:07:1a:16:4a:3f:42:6a:e1:74:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15761e8a78189f6c050d071a164a3f426ae174c3/; sid:903201400; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"07:49:c4:8b:dd:1c:ba:96:dd:5b:4d:8b:de:b8:95:e5:4c:db:cf:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0749c48bdd1cba96dd5b4d8bdeb895e54cdbcf7f/; sid:903201401; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"11:a8:f9:1e:9c:ed:99:fa:01:a5:f9:f3:e7:69:ae:d3:b9:96:50:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11a8f91e9ced99fa01a5f9f3e769aed3b99650f8/; sid:903201402; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"00:94:5e:df:41:cc:fa:28:99:df:d4:1d:71:b8:42:75:65:31:38:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00945edf41ccfa2899dfd41d71b8427565313820/; sid:903201403; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"12:b5:fc:f9:1f:d8:b5:c8:9a:74:b7:b6:91:ac:90:a3:66:fe:5a:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12b5fcf91fd8b5c89a74b7b691ac90a366fe5aca/; sid:903201404; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"da:be:87:24:55:89:72:9e:d8:81:f4:d1:5d:42:ec:09:f0:fc:ae:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dabe87245589729ed881f4d15d42ec09f0fcae6c/; sid:903201405; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c4:8e:de:ba:9a:63:b1:31:46:16:49:d2:0f:e6:5a:78:4a:5a:3f:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c48edeba9a63b131461649d20fe65a784a5a3fad/; sid:903201406; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4b:dd:42:de:62:85:6a:64:31:5d:2d:c6:12:b3:ce:87:94:f9:08:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4bdd42de62856a64315d2dc612b3ce8794f90895/; sid:903201407; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"bb:56:0c:df:03:50:e8:41:8a:6f:60:74:2e:5c:8a:18:ff:0f:80:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb560cdf0350e8418a6f60742e5c8a18ff0f8040/; sid:903201408; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c0:9d:8b:14:f1:92:fc:4e:c9:1c:e9:4a:ff:7c:1d:52:f8:1f:a5:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c09d8b14f192fc4ec91ce94aff7c1d52f81fa555/; sid:903201409; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0e:46:fd:94:50:41:13:bc:42:f1:02:66:72:23:9a:ab:82:49:96:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e46fd94504113bc42f1026672239aab8249962c/; sid:903201410; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c1:19:d0:8b:51:35:fe:42:1d:5d:56:2b:84:24:3a:bb:13:91:1e:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c119d08b5135fe421d5d562b84243abb13911efb/; sid:903201411; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ec:a6:d4:7e:51:1e:72:ae:f8:13:0d:3b:0d:0c:78:ce:a0:aa:2d:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eca6d47e511e72aef8130d3b0d0c78cea0aa2d30/; sid:903201412; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"21:07:c1:e3:60:90:a5:46:ee:56:c4:d1:a8:42:e5:e9:c6:0c:e2:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2107c1e36090a546ee56c4d1a842e5e9c60ce221/; sid:903201413; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"61:8f:fa:46:fe:59:2b:df:61:fe:f3:ac:d7:d0:4a:a6:eb:c4:d4:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/618ffa46fe592bdf61fef3acd7d04aa6ebc4d4f3/; sid:903201414; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c4:77:55:a7:e2:88:27:93:d7:ab:d6:f7:f0:57:c5:b5:71:69:fb:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c47755a7e2882793d7abd6f7f057c5b57169fbc5/; sid:903201415; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"c8:64:63:3b:d7:c4:32:ff:8a:b8:7b:5c:b1:a3:b3:3c:a8:62:99:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c864633bd7c432ff8ab87b5cb1a3b33ca8629926/; sid:903201416; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b1:b6:14:1d:df:f2:24:6b:c2:b6:53:bc:f6:ee:86:2c:e3:b3:09:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1b6141ddff2246bc2b653bcf6ee862ce3b309f6/; sid:903201417; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b8:b9:20:9d:ad:7e:b5:9d:bf:9a:b6:c2:2a:77:b6:20:07:c6:8a:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b8b9209dad7eb59dbf9ab6c22a77b62007c68ac5/; sid:903201418; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"50:1c:82:25:e8:7b:6f:b8:58:df:2e:05:93:75:09:dd:33:a3:4b:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/501c8225e87b6fb858df2e05937509dd33a34b58/; sid:903201419; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (RockLoader C&C)"; tls_cert_fingerprint; content:"ff:c3:bf:9b:72:df:3d:f1:0e:22:61:f5:70:ed:99:74:51:5e:1e:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ffc3bf9b72df3df10e2261f570ed9974515e1e2b/; sid:903201420; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"ac:99:29:98:8c:ab:80:0a:65:3b:01:12:ba:31:6c:47:25:d1:9f:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac9929988cab800a653b0112ba316c4725d19fc3/; sid:903201421; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"91:c9:4e:e2:98:fc:bd:a3:2e:ed:9c:67:59:97:92:04:a1:63:7c:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91c94ee298fcbda32eed9c6759979204a1637cbc/; sid:903201422; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:9e:4d:1c:20:7a:26:c4:c0:bd:4c:75:83:ae:b6:22:a9:c2:c1:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce9e4d1c207a26c4c0bd4c7583aeb622a9c2c1e9/; sid:903201423; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6b:bd:37:a0:3c:68:85:6c:cf:a1:d0:44:52:69:a4:30:14:32:d9:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6bbd37a03c68856ccfa1d0445269a4301432d9ee/; sid:903201424; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"11:62:b1:e7:e4:c9:16:6f:0e:74:be:ad:5b:e1:4c:1f:8d:68:ca:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1162b1e7e4c9166f0e74bead5be14c1f8d68ca62/; sid:903201425; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"18:86:4b:d0:12:31:a8:3c:ab:6a:6c:ea:2e:d3:76:9b:55:3d:5c:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18864bd01231a83cab6a6cea2ed3769b553d5ccf/; sid:903201426; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0c:45:ce:8c:56:fc:c4:00:b7:98:22:23:45:c2:4b:5d:38:60:21:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c45ce8c56fcc400b798222345c24b5d386021f4/; sid:903201427; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7d:0a:fe:78:52:11:80:19:f1:a2:1b:ba:51:2e:8d:88:aa:95:a5:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d0afe7852118019f1a21bba512e8d88aa95a506/; sid:903201428; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dd:eb:9c:78:d4:3d:90:9c:3b:c3:19:6b:80:7b:1d:5f:21:cf:d0:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddeb9c78d43d909c3bc3196b807b1d5f21cfd060/; sid:903201429; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"2b:52:fb:88:1d:57:95:90:6e:07:ed:e2:73:e4:45:2e:7f:35:57:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b52fb881d5795906e07ede273e4452e7f355755/; sid:903201430; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"67:75:a9:ca:ff:ab:72:56:b5:cb:30:fe:5d:a9:78:3c:18:b1:07:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6775a9caffab7256b5cb30fe5da9783c18b107bb/; sid:903201431; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"09:55:d4:14:ef:66:a2:51:c4:9f:8a:f6:95:9d:0a:44:1f:c8:cc:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0955d414ef66a251c49f8af6959d0a441fc8cc65/; sid:903201432; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"72:2b:94:4f:b5:12:34:9b:7f:72:00:25:9b:9d:49:1e:bc:f6:76:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/722b944fb512349b7f7200259b9d491ebcf6768e/; sid:903201433; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"dd:92:ad:90:f3:90:3d:6a:03:fc:98:d5:22:e1:2a:16:c5:ac:ba:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd92ad90f3903d6a03fc98d522e12a16c5acbafc/; sid:903201434; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"62:9e:d4:9f:00:e6:5e:13:28:56:1e:52:32:f5:68:29:00:53:48:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/629ed49f00e65e1328561e5232f568290053485b/; sid:903201435; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1a:45:0a:f1:e4:2f:98:a2:83:22:16:40:1b:cb:17:bb:73:ac:1d:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a450af1e42f98a2832216401bcb17bb73ac1d32/; sid:903201436; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (H1N1 C&C)"; tls_cert_fingerprint; content:"3a:71:6a:c2:45:91:76:11:da:c7:f5:7a:d3:93:a8:19:57:e0:f3:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a716ac245917611dac7f57ad393a81957e0f386/; sid:903201437; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b2:ab:ff:c7:53:d5:55:76:e1:9f:22:37:80:7e:69:1e:2a:ba:f3:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2abffc753d55576e19f2237807e691e2abaf3af/; sid:903201438; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"ee:90:55:2b:ae:63:b3:f8:c8:74:bb:66:a9:6e:1f:7b:b1:e0:a5:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee90552bae63b3f8c874bb66a96e1f7bb1e0a595/; sid:903201439; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"79:5a:e7:76:68:04:58:0e:e7:d3:db:01:ce:24:a1:78:df:9e:de:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/795ae7766804580ee7d3db01ce24a178df9ede23/; sid:903201440; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"62:e9:30:b1:3d:24:0f:e4:ca:ef:56:1c:90:d4:88:9e:9b:25:11:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62e930b13d240fe4caef561c90d4889e9b25119b/; sid:903201441; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b0:82:c7:f2:3c:49:39:1c:03:3d:05:37:4c:ad:e3:44:e6:d0:a0:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b082c7f23c49391c033d05374cade344e6d0a095/; sid:903201442; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"78:24:e5:3f:1e:c2:c9:e8:89:6e:24:69:51:9a:c8:60:15:34:50:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7824e53f1ec2c9e8896e2469519ac860153450de/; sid:903201443; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"53:f3:53:bf:17:fb:83:80:9c:7a:36:69:ae:72:b0:8f:27:58:55:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53f353bf17fb83809c7a3669ae72b08f275855df/; sid:903201444; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ce:7c:5b:4a:26:07:c4:8a:1e:34:28:ce:45:58:2a:ba:1d:a2:18:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce7c5b4a2607c48a1e3428ce45582aba1da21812/; sid:903201445; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e8:14:a1:ca:9c:80:d9:63:bf:43:e9:8f:68:33:af:ea:a8:73:81:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e814a1ca9c80d963bf43e98f6833afeaa8738108/; sid:903201446; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e8:6a:7d:ef:d8:37:17:d2:29:b2:8f:26:3c:cb:74:30:0e:ff:6b:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e86a7defd83717d229b28f263ccb74300eff6b9a/; sid:903201447; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d5:64:e3:c1:f3:cb:f2:56:d9:76:bd:8c:07:bb:22:40:09:c3:9a:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d564e3c1f3cbf256d976bd8c07bb224009c39a0a/; sid:903201448; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"86:fd:7e:1c:08:0b:d4:d1:50:7c:6f:25:94:c7:be:62:df:08:44:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86fd7e1c080bd4d1507c6f2594c7be62df0844e9/; sid:903201449; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"62:10:1d:5a:29:89:91:9f:19:09:2e:b6:b7:3d:1a:39:ce:1c:00:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62101d5a2989919f19092eb6b73d1a39ce1c00d9/; sid:903201450; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c9:d8:13:17:9c:e2:af:bc:ff:6f:73:48:87:c4:ff:6b:e0:33:5e:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9d813179ce2afbcff6f734887c4ff6be0335e0a/; sid:903201451; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"69:dc:a2:80:43:55:56:41:43:f2:1c:eb:cd:42:8b:5c:ca:d0:83:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69dca2804355564143f21cebcd428b5ccad08311/; sid:903201452; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ab:a2:0d:f9:de:f8:ee:a6:7e:9b:d4:51:3e:3b:4e:aa:84:d7:47:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aba20df9def8eea67e9bd4513e3b4eaa84d7470d/; sid:903201453; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"42:c3:4e:c2:cf:08:4d:f0:75:31:12:9e:22:75:04:68:59:85:e7:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/42c34ec2cf084df07531129e227504685985e766/; sid:903201454; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ee:c7:bf:78:cf:94:a4:f7:f7:5c:64:bc:ec:4a:2c:4d:cd:26:0e:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eec7bf78cf94a4f7f75c64bcec4a2c4dcd260eab/; sid:903201455; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"fd:8e:06:77:99:1e:ef:52:02:bf:55:56:61:af:ae:70:ab:7e:ea:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd8e0677991eef5202bf555661afae70ab7eea47/; sid:903201456; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ed:b8:8d:d3:be:67:4a:9c:f4:85:0f:4e:40:32:56:81:b6:aa:c8:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/edb88dd3be674a9cf4850f4e40325681b6aac8d3/; sid:903201457; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"50:c1:e8:61:d0:2c:a2:35:05:17:4e:f7:c0:74:a8:63:6c:fa:5f:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50c1e861d02ca23505174ef7c074a8636cfa5f90/; sid:903201458; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"19:39:a1:55:90:6f:e3:47:6a:9d:43:e1:59:0e:d6:8a:bb:ba:8a:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1939a155906fe3476a9d43e1590ed68abbba8abb/; sid:903201459; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7d:cf:44:72:48:99:4c:c8:0d:de:b4:c5:96:a5:3f:be:16:f7:39:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7dcf447248994cc80ddeb4c596a53fbe16f739ef/; sid:903201460; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f4:38:7c:38:ff:9e:46:df:e3:48:07:28:fc:50:26:c6:1e:48:78:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4387c38ff9e46dfe3480728fc5026c61e4878ed/; sid:903201461; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"48:0f:10:01:35:82:88:47:30:85:a5:4b:5d:11:24:6f:9e:d4:b1:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/480f1001358288473085a54b5d11246f9ed4b188/; sid:903201462; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"77:63:84:c4:9c:c8:93:13:9b:68:0f:a9:2d:a8:2a:11:d7:54:a2:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/776384c49cc893139b680fa92da82a11d754a25f/; sid:903201463; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"8d:fb:92:83:89:c4:b4:08:89:b1:ad:eb:50:6c:a6:d6:2a:e3:42:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8dfb928389c4b40889b1adeb506ca6d62ae3422e/; sid:903201464; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"66:a1:a0:37:e8:29:68:05:1b:63:ec:f0:22:1f:e6:42:c8:23:10:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66a1a037e82968051b63ecf0221fe642c8231029/; sid:903201465; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f0:6c:b2:a9:49:fe:48:93:17:77:00:d0:f7:b7:da:ea:a7:e1:03:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f06cb2a949fe4893177700d0f7b7daeaa7e10317/; sid:903201466; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d1:fa:32:b4:13:e9:27:12:08:22:53:f5:ed:c4:f5:79:90:06:e2:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1fa32b413e92712082253f5edc4f5799006e294/; sid:903201467; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"9b:e4:ab:3c:d5:8a:13:2b:65:2e:c3:9f:c5:0e:41:f2:cc:93:a4:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9be4ab3cd58a132b652ec39fc50e41f2cc93a44b/; sid:903201468; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"be:77:9d:c4:95:e7:c1:6a:61:c5:bd:3b:3d:ae:f5:d6:f4:84:bd:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be779dc495e7c16a61c5bd3b3daef5d6f484bd02/; sid:903201469; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b4:4b:59:4d:09:b3:82:5a:c4:4b:5f:24:33:43:c9:bf:b7:6c:fe:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b44b594d09b3825ac44b5f243343c9bfb76cfec7/; sid:903201470; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"2c:54:2e:32:c6:cb:a4:b4:99:d1:42:f9:57:51:97:06:ac:53:3a:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c542e32c6cba4b499d142f957519706ac533a1f/; sid:903201471; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"96:63:b6:79:9b:a2:0d:68:73:4c:c9:9a:a8:3d:6b:bb:05:06:f0:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9663b6799ba20d68734cc99aa83d6bbb0506f064/; sid:903201472; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"54:d4:b6:c4:8e:d2:07:e2:a4:11:e0:d8:04:08:8d:9a:e0:00:c8:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54d4b6c48ed207e2a411e0d804088d9ae000c85c/; sid:903201473; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8c:91:ea:76:23:94:e0:94:aa:ec:33:3a:b5:0b:ee:0d:d2:4e:11:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c91ea762394e094aaec333ab50bee0dd24e1102/; sid:903201474; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bf:58:38:a9:93:4b:99:55:61:ac:b7:89:3a:70:12:75:40:42:4c:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf5838a9934b995561acb7893a70127540424ca4/; sid:903201475; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"3b:4e:f6:5e:f0:b5:af:89:ec:98:53:ae:ad:53:05:1f:6d:ff:5c:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b4ef65ef0b5af89ec9853aead53051f6dff5c0a/; sid:903201476; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a0:1f:76:da:b7:4e:1e:a9:52:91:24:05:96:88:7d:42:b1:81:64:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a01f76dab74e1ea95291240596887d42b18164f4/; sid:903201477; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"fb:c5:51:bf:c0:6f:94:f9:46:0e:ab:40:21:37:68:5b:56:5f:39:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fbc551bfc06f94f9460eab402137685b565f3985/; sid:903201478; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"25:1b:e2:d8:16:49:44:66:bb:6a:23:bc:3d:f9:bc:73:bd:ec:ea:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/251be2d816494466bb6a23bc3df9bc73bdeceab0/; sid:903201479; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5c:b0:f8:39:0c:9a:07:a8:a1:a9:7d:88:ad:49:35:f9:d3:5d:92:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5cb0f8390c9a07a8a1a97d88ad4935f9d35d92e7/; sid:903201480; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"93:53:26:06:c0:c0:1c:e7:94:f9:c7:25:fe:63:a1:c9:bb:1c:9a:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93532606c0c01ce794f9c725fe63a1c9bb1c9a7c/; sid:903201481; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"67:2f:29:f8:cf:cd:b9:49:4e:f2:c6:43:d6:20:8c:19:b6:8e:95:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/672f29f8cfcdb9494ef2c643d6208c19b68e953f/; sid:903201482; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"94:75:a7:c4:d1:9d:9d:ac:68:ce:09:77:a9:ec:46:23:c7:c3:95:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9475a7c4d19d9dac68ce0977a9ec4623c7c395b7/; sid:903201483; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ec:2c:fd:44:3b:d4:67:69:cf:f7:81:38:a9:5f:88:4f:32:72:63:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec2cfd443bd46769cff78138a95f884f32726387/; sid:903201484; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"25:fd:0b:a7:66:0d:05:52:47:45:d6:dc:ad:0c:bd:7d:8b:bc:b1:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25fd0ba7660d05524745d6dcad0cbd7d8bbcb169/; sid:903201485; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"81:bf:49:7b:56:15:bd:45:57:b8:70:b5:21:3b:a0:18:e6:11:3d:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/81bf497b5615bd4557b870b5213ba018e6113d48/; sid:903201486; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"74:27:91:20:25:6b:c0:96:1b:a2:7a:cd:52:d0:41:f4:16:4e:86:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/74279120256bc0961ba27acd52d041f4164e863f/; sid:903201487; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5b:03:85:98:fb:63:ca:7c:93:5f:a8:ac:7b:7a:b7:1f:de:89:bd:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b038598fb63ca7c935fa8ac7b7ab71fde89bd6b/; sid:903201488; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6a:ec:a8:f9:e1:02:ca:cc:4d:f5:2b:a7:54:00:47:0d:ce:d6:f6:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6aeca8f9e102cacc4df52ba75400470dced6f690/; sid:903201489; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d1:fa:73:cc:db:4b:36:11:37:09:ad:ff:3c:8e:e8:0c:bc:f6:e2:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1fa73ccdb4b36113709adff3c8ee80cbcf6e2ce/; sid:903201490; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"06:83:50:6f:22:15:1f:54:45:fa:08:0f:32:25:91:90:de:d1:ab:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0683506f22151f5445fa080f32259190ded1ab42/; sid:903201491; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"54:06:85:89:04:53:84:51:5a:45:84:88:3c:7d:39:38:53:54:c8:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54068589045384515a4584883c7d39385354c8de/; sid:903201492; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"dd:be:a7:ab:02:af:e4:4d:5b:fc:1d:be:f0:90:f2:6c:8b:01:e8:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddbea7ab02afe44d5bfc1dbef090f26c8b01e823/; sid:903201493; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"90:3d:fd:be:81:a8:01:6d:5f:c4:05:e1:e7:6f:22:9d:de:e5:04:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/903dfdbe81a8016d5fc405e1e76f229ddee5045c/; sid:903201494; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5e:89:e6:07:8c:be:b2:21:ae:f7:36:e7:49:0c:03:1c:74:88:18:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e89e6078cbeb221aef736e7490c031c748818f6/; sid:903201495; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"15:5f:9a:76:e7:6f:f2:29:3a:3a:28:3f:23:24:48:d3:71:7c:90:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/155f9a76e76ff2293a3a283f232448d3717c9097/; sid:903201496; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3c:ad:c4:99:ea:df:d2:37:f6:2d:17:47:bc:ce:fb:78:a8:9e:f2:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cadc499eadfd237f62d1747bccefb78a89ef295/; sid:903201497; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d3:28:2b:a8:32:45:f7:df:f4:c0:f8:eb:25:7f:2c:f7:8e:f4:03:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3282ba83245f7dff4c0f8eb257f2cf78ef40360/; sid:903201498; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e9:27:61:0a:7a:36:e0:e2:20:e6:ce:54:a1:f4:68:53:c5:d4:4b:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e927610a7a36e0e220e6ce54a1f46853c5d44bbe/; sid:903201499; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1b:3f:55:9b:b1:04:50:a5:8b:6d:6b:94:25:08:81:be:c3:db:1b:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b3f559bb10450a58b6d6b94250881bec3db1bb4/; sid:903201500; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"76:c7:c0:90:dc:32:3f:56:e2:c0:31:11:ca:92:ae:67:ef:a5:8d:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/76c7c090dc323f56e2c03111ca92ae67efa58db0/; sid:903201501; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"09:c5:02:c2:e9:67:fe:f1:b1:81:50:f6:0e:20:c0:41:c4:84:ef:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09c502c2e967fef1b18150f60e20c041c484ef62/; sid:903201502; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b1:d5:1e:8c:09:5d:01:ef:20:c7:6b:7f:4c:a7:68:43:1e:a0:46:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1d51e8c095d01ef20c76b7f4ca768431ea04628/; sid:903201503; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"35:a2:b2:d7:84:b0:e1:26:1a:12:cd:3f:61:9f:55:d8:59:36:76:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35a2b2d784b0e1261a12cd3f619f55d85936763d/; sid:903201504; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c7:16:75:67:38:aa:fa:01:29:43:1e:69:f6:73:ab:ca:2b:14:09:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c716756738aafa0129431e69f673abca2b140975/; sid:903201505; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Downloader.Pony C&C)"; tls_cert_fingerprint; content:"e2:79:81:1f:74:ac:19:2d:ed:19:52:2e:b8:cd:5b:88:ba:fd:47:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e279811f74ac192ded19522eb8cd5b88bafd47cc/; sid:903201506; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"cf:ab:4c:e6:f2:25:9d:74:e8:aa:41:e3:0e:c7:e1:ce:98:3f:9a:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfab4ce6f2259d74e8aa41e30ec7e1ce983f9a17/; sid:903201507; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"03:99:b4:d2:13:2a:02:7f:5e:69:a9:9e:2f:d5:29:fc:e1:9a:42:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0399b4d2132a027f5e69a99e2fd529fce19a42ab/; sid:903201508; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"42:ea:2a:4d:e6:56:40:10:0d:72:23:e9:75:2d:07:83:cf:56:ad:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/42ea2a4de65640100d7223e9752d0783cf56ad58/; sid:903201509; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3c:ee:08:dc:89:08:8d:a5:ca:35:f8:cf:12:29:ea:42:a6:78:f2:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cee08dc89088da5ca35f8cf1229ea42a678f2c5/; sid:903201510; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"98:6f:0d:81:63:60:16:3f:03:eb:b8:dd:37:24:9b:69:9e:65:cc:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/986f0d816360163f03ebb8dd37249b699e65cc24/; sid:903201511; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"49:4f:05:60:e1:20:b7:5b:10:7d:dc:3a:22:17:58:cc:15:2a:83:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/494f0560e120b75b107ddc3a221758cc152a8385/; sid:903201512; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4b:9c:1b:73:66:16:2a:65:f2:0f:cf:ae:74:04:32:6a:dc:5a:99:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4b9c1b7366162a65f20fcfae7404326adc5a9960/; sid:903201513; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"73:d8:ec:1f:29:19:5e:f2:d9:e0:b6:18:e7:2f:3c:80:c0:ac:6b:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73d8ec1f29195ef2d9e0b618e72f3c80c0ac6ba7/; sid:903201514; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1a:e2:81:e3:2a:78:6a:cf:8a:fd:28:c2:70:e6:a5:0c:8a:29:02:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ae281e32a786acf8afd28c270e6a50c8a290233/; sid:903201515; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"08:17:e0:e3:aa:88:56:9f:70:c4:a7:9d:a4:e1:da:cc:6c:03:40:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0817e0e3aa88569f70c4a79da4e1dacc6c034058/; sid:903201516; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cf:b8:6f:7a:5e:dc:30:cb:ce:ef:cf:57:2d:89:12:e1:8e:eb:c5:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfb86f7a5edc30cbceefcf572d8912e18eebc583/; sid:903201517; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cd:08:b5:57:1b:d2:d5:cb:da:b9:7f:00:e5:ee:8d:64:c6:d5:d6:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd08b5571bd2d5cbdab97f00e5ee8d64c6d5d6c4/; sid:903201518; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e9:ff:e9:4c:89:41:1b:cb:c5:8f:3a:8a:3b:63:68:f0:24:36:73:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9ffe94c89411bcbc58f3a8a3b6368f024367302/; sid:903201519; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6d:ba:b1:c9:41:d5:74:e3:78:17:5d:78:87:a3:3a:76:2a:32:7e:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6dbab1c941d574e378175d7887a33a762a327e42/; sid:903201520; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"12:d0:c4:77:0b:7c:dd:7a:9b:3a:32:82:8b:61:bb:bc:80:c9:62:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12d0c4770b7cdd7a9b3a32828b61bbbc80c962e4/; sid:903201521; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"f9:f3:22:5b:7b:9e:a4:ac:04:42:89:ff:cc:8a:33:ee:3b:df:a6:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f9f3225b7b9ea4ac044289ffcc8a33ee3bdfa6ef/; sid:903201522; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"88:37:c6:82:2f:45:d9:b9:9c:eb:58:2f:5d:98:c8:27:89:47:7e:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8837c6822f45d9b99ceb582f5d98c82789477ea4/; sid:903201523; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"bf:cf:9c:b6:e2:67:b0:60:37:03:9b:5a:a7:cd:c4:03:bb:92:fa:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bfcf9cb6e267b06037039b5aa7cdc403bb92fac2/; sid:903201524; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4a:b3:d7:5c:4d:15:a7:75:68:6b:19:21:a3:82:59:d9:ea:e6:46:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ab3d75c4d15a775686b1921a38259d9eae64620/; sid:903201525; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a1:fb:81:ab:f5:e0:45:3e:6f:b1:29:b5:e2:58:3b:17:1b:fd:e4:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a1fb81abf5e0453e6fb129b5e2583b171bfde416/; sid:903201526; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fa:6c:d2:47:8a:9a:31:8c:2f:f8:3d:f1:32:b7:5b:4b:e7:2d:ab:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa6cd2478a9a318c2ff83df132b75b4be72dab28/; sid:903201527; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"55:00:8f:ce:90:54:e4:7b:5b:14:61:b7:66:c2:44:3b:b2:73:c4:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55008fce9054e47b5b1461b766c2443bb273c4b1/; sid:903201528; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fa:d4:0c:e0:ba:6f:e3:31:bb:b7:ae:fc:aa:d2:69:d8:bc:86:5c:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fad40ce0ba6fe331bbb7aefcaad269d8bc865cb2/; sid:903201529; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8e:29:49:47:d3:57:fd:2b:76:09:7e:db:2f:30:b2:eb:0e:61:87:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8e294947d357fd2b76097edb2f30b2eb0e618717/; sid:903201530; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"63:22:a9:e1:7b:a0:0b:8a:be:ae:60:dd:f2:f0:d9:3b:7a:b5:cd:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6322a9e17ba00b8abeae60ddf2f0d93b7ab5cd94/; sid:903201531; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f2:3f:07:fb:0d:e5:72:9e:79:b2:9b:4c:20:5d:39:2b:45:dc:98:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f23f07fb0de5729e79b29b4c205d392b45dc98a9/; sid:903201532; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"07:57:2d:4e:9d:91:6d:35:9a:7e:a5:bc:03:6a:09:26:cd:cb:b1:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/07572d4e9d916d359a7ea5bc036a0926cdcbb128/; sid:903201533; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b0:9b:ca:1e:01:bf:3b:f5:5b:b4:54:71:f8:35:d2:bb:8b:8d:ad:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b09bca1e01bf3bf55bb45471f835d2bb8b8dadf9/; sid:903201534; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6f:7b:dd:d7:24:32:66:8d:16:d4:29:50:45:98:e8:88:98:65:f5:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f7bddd72432668d16d429504598e8889865f50e/; sid:903201535; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"45:69:14:03:1e:5d:57:88:d6:ad:41:b7:21:1b:7a:01:c0:4d:7c:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/456914031e5d5788d6ad41b7211b7a01c04d7cae/; sid:903201536; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"7f:fd:7b:c9:90:c3:eb:78:49:ef:9c:46:35:d8:c5:a8:fb:16:a7:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7ffd7bc990c3eb7849ef9c4635d8c5a8fb16a7bf/; sid:903201537; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"56:d7:27:1a:71:d6:73:a7:6b:43:f2:a9:8f:c9:10:c2:fe:11:7f:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/56d7271a71d673a76b43f2a98fc910c2fe117f24/; sid:903201538; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e8:99:57:33:f6:ea:a1:22:02:df:81:20:6d:0d:d4:69:e7:9d:94:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8995733f6eaa12202df81206d0dd469e79d94c7/; sid:903201539; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d1:f7:3d:cc:44:11:72:80:50:d3:fc:4a:22:24:26:3b:af:ff:fc:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1f73dcc4411728050d3fc4a2224263baffffcdd/; sid:903201540; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e9:75:be:d4:20:61:b5:8e:f7:6d:d4:4c:d6:9c:8e:82:b0:39:d7:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e975bed42061b58ef76dd44cd69c8e82b039d730/; sid:903201541; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Hancitor C&C)"; tls_cert_fingerprint; content:"a3:05:27:ca:8a:de:21:87:1e:72:98:d5:b3:2e:75:0b:9e:58:d7:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a30527ca8ade21871e7298d5b32e750b9e58d79d/; sid:903201542; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"db:97:cb:b7:25:58:88:68:ac:8a:90:36:e0:96:aa:4f:01:17:a9:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db97cbb725588868ac8a9036e096aa4f0117a99b/; sid:903201543; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"92:b2:68:6b:8f:00:7b:93:77:2b:fd:de:74:bd:cb:d8:2d:46:43:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92b2686b8f007b93772bfdde74bdcbd82d4643cc/; sid:903201544; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"72:3a:d7:c1:18:e3:22:c5:dd:0f:71:84:d2:7b:79:5f:0a:9b:20:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/723ad7c118e322c5dd0f7184d27b795f0a9b20cf/; sid:903201545; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d3:40:fc:07:78:47:ac:74:6c:f8:66:41:2b:a9:ed:ef:5f:10:85:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d340fc077847ac746cf866412ba9edef5f1085c7/; sid:903201546; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ba:42:1e:58:62:4e:ff:e4:5f:55:78:79:7e:82:e5:e8:b0:40:65:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba421e58624effe45f5578797e82e5e8b0406585/; sid:903201547; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"91:55:e4:cd:a1:6d:df:06:54:c0:e8:3d:a8:2a:3e:aa:ff:da:99:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9155e4cda16ddf0654c0e83da82a3eaaffda9962/; sid:903201548; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4d:8d:c8:00:54:35:6a:31:55:48:66:9b:9f:9e:94:16:de:c0:42:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d8dc80054356a315548669b9f9e9416dec042ba/; sid:903201549; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"25:03:30:b5:39:ae:6c:71:2f:9e:7d:07:f9:51:93:e5:90:c0:8b:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/250330b539ae6c712f9e7d07f95193e590c08bc2/; sid:903201550; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"f3:75:7b:64:d9:e4:31:2e:6b:04:4c:b2:0e:e1:75:07:ca:89:23:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f3757b64d9e4312e6b044cb20ee17507ca8923d3/; sid:903201551; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6d:5f:9b:fb:1b:76:8c:3f:da:90:46:6d:96:bb:15:51:df:d9:ee:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d5f9bfb1b768c3fda90466d96bb1551dfd9ee0b/; sid:903201552; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"2b:29:68:f0:4b:b6:55:6e:c2:91:b8:44:3c:23:04:75:4c:9a:d7:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b2968f04bb6556ec291b8443c2304754c9ad7f1/; sid:903201553; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"a5:cc:5f:0f:b6:3d:b7:ef:4f:8c:99:cf:49:28:75:3c:ea:90:29:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5cc5f0fb63db7ef4f8c99cf4928753cea90295c/; sid:903201554; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"5b:ca:53:43:b1:de:a0:09:6e:d7:b2:07:fc:d3:d3:83:1e:a6:d1:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5bca5343b1dea0096ed7b207fcd3d3831ea6d130/; sid:903201555; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a5:49:80:fc:f6:de:b0:53:77:d0:94:d2:ff:07:11:2d:7e:c1:05:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a54980fcf6deb05377d094d2ff07112d7ec105cc/; sid:903201556; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cf:9a:b3:62:35:0c:23:5b:b2:90:25:0f:9a:62:33:ac:12:72:9a:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf9ab362350c235bb290250f9a6233ac12729ab2/; sid:903201557; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"fd:51:bc:1d:19:8d:9f:42:f9:8b:4e:22:bc:a8:9a:6e:41:be:27:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd51bc1d198d9f42f98b4e22bca89a6e41be27c8/; sid:903201558; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"f8:cf:b4:79:0c:d5:b2:71:05:ee:c5:6d:e9:dc:2e:2b:5f:4d:c8:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f8cfb4790cd5b27105eec56de9dc2e2b5f4dc846/; sid:903201559; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ca:9e:2e:b0:7d:8f:75:6a:97:74:1f:12:94:11:de:93:9f:1c:67:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca9e2eb07d8f756a97741f129411de939f1c67e1/; sid:903201560; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"ca:e1:54:2c:5d:83:cd:78:16:3d:00:96:91:68:08:03:25:d4:ac:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cae1542c5d83cd78163d00969168080325d4ac4f/; sid:903201561; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0f:20:6c:9a:95:22:ca:50:c6:df:64:0e:3f:7d:be:bf:aa:b8:17:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f206c9a9522ca50c6df640e3f7dbebfaab817fc/; sid:903201562; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"1d:68:f8:64:01:bb:75:01:7c:01:a9:a5:53:ff:f3:37:c2:a7:37:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d68f86401bb75017c01a9a553fff337c2a737c6/; sid:903201563; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"1c:8b:d9:5b:67:ad:70:ab:dd:e9:f7:37:87:fc:15:f0:88:1e:a3:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c8bd95b67ad70abdde9f73787fc15f0881ea33f/; sid:903201564; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (RockLoader C&C)"; tls_cert_fingerprint; content:"7e:75:cd:f9:22:b9:a2:4f:86:da:31:58:1a:e4:c6:2d:c1:bd:25:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e75cdf922b9a24f86da31581ae4c62dc1bd25b0/; sid:903201565; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6f:40:b3:08:16:49:1b:23:5e:ff:b3:02:97:af:50:78:95:7d:b7:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f40b30816491b235effb30297af5078957db75e/; sid:903201566; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b1:a1:f7:38:f7:e4:c3:6d:e3:9c:4f:46:22:b5:e8:b4:d1:58:62:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1a1f738f7e4c36de39c4f4622b5e8b4d15862e7/; sid:903201567; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"eb:52:85:89:e1:b4:23:05:c6:78:0a:05:96:09:b8:9b:90:79:b7:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb528589e1b42305c6780a059609b89b9079b7f7/; sid:903201568; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"af:50:d0:af:aa:f5:c0:bf:5a:6b:04:6d:93:83:9a:d4:02:56:40:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af50d0afaaf5c0bf5a6b046d93839ad402564005/; sid:903201569; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"e1:d3:8d:99:d7:b3:d1:9d:d3:c4:0e:8d:a7:ec:d4:d8:b8:5b:67:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1d38d99d7b3d19dd3c40e8da7ecd4d8b85b675e/; sid:903201570; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ec:ef:03:ad:9f:e7:b8:81:42:52:6b:ca:b5:29:78:13:6f:95:db:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecef03ad9fe7b88142526bcab52978136f95db1d/; sid:903201571; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6b:67:10:99:7c:bb:00:db:5b:50:bb:76:15:e7:6d:54:ff:36:d3:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b6710997cbb00db5b50bb7615e76d54ff36d3f7/; sid:903201572; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"89:1f:bb:78:d4:2e:3e:b6:93:a9:ca:7c:cf:50:28:fd:25:ca:f8:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/891fbb78d42e3eb693a9ca7ccf5028fd25caf8a7/; sid:903201573; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"61:ea:f7:39:f5:a9:ce:3b:3e:fb:76:f3:b6:2e:50:78:dd:0d:b1:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/61eaf739f5a9ce3b3efb76f3b62e5078dd0db193/; sid:903201574; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c6:5e:76:a5:54:7c:16:41:7f:36:a2:f9:12:7b:19:6e:cd:86:a8:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c65e76a5547c16417f36a2f9127b196ecd86a8ac/; sid:903201575; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a2:55:60:55:34:34:23:ad:37:59:8d:a0:9e:9a:7b:f4:52:25:51:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a2556055343423ad37598da09e9a7bf452255140/; sid:903201576; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c7:f6:c0:2c:88:08:f6:e4:9b:4f:d1:f4:b0:fc:08:ed:e6:1e:5d:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c7f6c02c8808f6e49b4fd1f4b0fc08ede61e5ded/; sid:903201577; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2e:79:6e:28:e2:aa:dd:7f:65:7c:db:c8:53:22:6f:f2:f8:49:80:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e796e28e2aadd7f657cdbc853226ff2f84980e4/; sid:903201578; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8a:50:ad:95:29:98:4d:f8:94:b8:59:1e:7e:19:3f:ce:30:eb:9f:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a50ad9529984df894b8591e7e193fce30eb9fa8/; sid:903201579; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cc:f9:26:3d:e3:eb:09:b9:08:c7:91:ba:b1:0a:c1:f7:38:c0:d9:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ccf9263de3eb09b908c791bab10ac1f738c0d9e8/; sid:903201580; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e5:06:91:f1:1e:bf:3d:91:60:a8:20:d7:c9:05:e2:b0:0f:6c:2d:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e50691f11ebf3d9160a820d7c905e2b00f6c2d9c/; sid:903201581; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c0:5d:8b:e1:bb:8d:b7:3d:62:5e:77:e8:de:0c:d6:25:4a:8f:0d:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c05d8be1bb8db73d625e77e8de0cd6254a8f0d75/; sid:903201582; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8d:bb:ad:65:31:d9:d3:01:b8:ae:64:09:7e:5f:9c:8c:a2:c9:01:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8dbbad6531d9d301b8ae64097e5f9c8ca2c901ef/; sid:903201583; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"48:6e:3f:b2:77:a2:5b:9f:4c:b6:a2:f1:09:a0:b5:17:f8:15:19:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/486e3fb277a25b9f4cb6a2f109a0b517f815193f/; sid:903201584; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d4:bb:3b:06:b5:00:67:cc:f5:b9:22:ea:a6:7c:f5:fe:0e:6c:c9:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4bb3b06b50067ccf5b922eaa67cf5fe0e6cc9ff/; sid:903201585; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"29:48:9e:12:a9:07:4a:70:02:43:50:cb:d9:d0:d5:94:45:f9:a6:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/29489e12a9074a70024350cbd9d0d59445f9a655/; sid:903201586; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1a:17:f1:01:f6:5e:46:19:de:08:a8:e4:03:d1:29:74:df:94:eb:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a17f101f65e4619de08a8e403d12974df94ebfa/; sid:903201587; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6b:a0:28:8a:54:a4:ac:dc:e0:01:e9:e3:d2:a6:bb:69:ed:c5:05:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ba0288a54a4acdce001e9e3d2a6bb69edc50532/; sid:903201588; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"87:61:5b:b0:1f:c6:fa:61:88:1b:f4:33:38:6a:49:e0:17:8c:91:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87615bb01fc6fa61881bf433386a49e0178c91d4/; sid:903201589; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1d:83:93:b9:fd:9a:a0:b4:c7:7e:aa:bd:53:cb:34:1d:b1:1b:a4:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d8393b9fd9aa0b4c77eaabd53cb341db11ba41e/; sid:903201590; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"2e:00:b1:6d:b0:9e:78:00:72:48:d5:43:83:b9:7e:a9:ef:3b:54:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e00b16db09e78007248d54383b97ea9ef3b54a4/; sid:903201591; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7d:2e:e4:2f:4f:0a:70:86:3a:3c:8d:04:59:99:52:4b:d2:2f:62:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d2ee42f4f0a70863a3c8d045999524bd22f62bc/; sid:903201592; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"33:c3:d1:f2:64:76:24:ca:dd:a3:f0:f9:86:08:41:08:bb:2a:94:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33c3d1f2647624cadda3f0f986084108bb2a941b/; sid:903201593; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"89:be:3a:84:0c:2d:18:96:e4:4f:15:14:82:e5:2e:93:2f:d0:2b:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89be3a840c2d1896e44f151482e52e932fd02b9f/; sid:903201594; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"8b:31:91:e6:a7:4e:86:db:88:65:a5:95:ab:65:ac:3d:0f:82:5e:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b3191e6a74e86db8865a595ab65ac3d0f825e10/; sid:903201595; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5a:5d:28:91:8c:c1:44:bf:b4:a3:1f:5c:92:60:e3:d4:0d:6b:81:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5a5d28918cc144bfb4a31f5c9260e3d40d6b811d/; sid:903201596; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"29:91:b5:87:99:4b:cf:fa:56:95:21:43:45:bd:8c:82:45:d7:78:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2991b587994bcffa5695214345bd8c8245d7786c/; sid:903201597; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"02:1c:92:b4:d4:6d:bc:31:58:9b:3d:b9:77:35:db:8b:f5:1a:d6:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/021c92b4d46dbc31589b3db97735db8bf51ad65a/; sid:903201598; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"cf:b1:71:e9:03:18:6d:96:9d:c2:87:50:bb:f7:77:c4:ee:48:61:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfb171e903186d969dc28750bbf777c4ee4861f6/; sid:903201599; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e5:5c:47:6b:3b:8a:bd:15:67:49:1a:a9:39:13:41:0a:9b:b9:be:62"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e55c476b3b8abd1567491aa93913410a9bb9be62/; sid:903201600; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ee:53:9b:1e:90:a8:db:4d:00:79:3b:ef:1f:1d:c5:7e:5a:ba:97:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee539b1e90a8db4d00793bef1f1dc57e5aba9706/; sid:903201601; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a2:d8:2b:dd:7d:c3:ab:6a:3d:48:19:89:53:cb:13:1d:ab:87:17:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a2d82bdd7dc3ab6a3d48198953cb131dab8717a0/; sid:903201602; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"bb:53:aa:5a:c3:ec:91:52:2b:a6:fa:32:b6:d1:9e:0d:16:63:0c:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb53aa5ac3ec91522ba6fa32b6d19e0d16630c8a/; sid:903201603; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e5:8f:32:e9:10:1b:92:8f:a9:8a:b0:f7:0c:d9:b5:84:68:13:b5:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e58f32e9101b928fa98ab0f70cd9b5846813b523/; sid:903201604; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9a:6f:a1:bd:e6:ba:d7:5c:55:17:81:97:b8:12:3c:c4:ed:65:8f:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a6fa1bde6bad75c55178197b8123cc4ed658f50/; sid:903201605; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d9:dd:7d:1e:38:16:83:06:95:bc:3e:53:2f:35:ea:b2:64:ec:e7:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9dd7d1e3816830695bc3e532f35eab264ece7a8/; sid:903201606; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"46:ed:d8:d4:49:51:65:0a:5b:e5:ae:a5:fe:d3:91:4c:df:5a:3a:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46edd8d44951650a5be5aea5fed3914cdf5a3ad0/; sid:903201607; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4d:47:e2:a1:9f:d9:01:92:dc:3b:2d:17:89:a0:60:37:2b:c5:cd:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d47e2a19fd90192dc3b2d1789a060372bc5cd48/; sid:903201608; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"75:16:f7:0c:b9:a1:d4:f2:f3:a5:71:56:77:1c:70:7d:04:5c:f1:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7516f70cb9a1d4f2f3a57156771c707d045cf143/; sid:903201609; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"27:bb:8d:2c:44:6d:fc:fe:e4:65:40:79:ef:8f:00:b0:af:db:c3:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27bb8d2c446dfcfee4654079ef8f00b0afdbc333/; sid:903201610; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c2:20:d2:04:95:40:32:25:aa:ba:cb:66:05:87:e2:55:51:83:9e:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c220d20495403225aabacb660587e25551839eef/; sid:903201611; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"55:2d:23:48:f1:01:37:4d:b7:d9:a3:24:9f:4f:d9:a3:7f:52:70:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/552d2348f101374db7d9a3249f4fd9a37f5270cf/; sid:903201612; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"55:00:44:83:a0:ff:8a:ce:b9:e1:c6:5d:f4:07:61:d7:45:76:63:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55004483a0ff8aceb9e1c65df40761d7457663ad/; sid:903201613; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"de:80:19:40:6c:b5:0a:7c:53:82:ed:8c:86:cb:46:8b:06:ee:6e:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de8019406cb50a7c5382ed8c86cb468b06ee6e24/; sid:903201614; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4c:f1:34:33:ad:87:84:ca:e0:53:fe:51:a3:86:43:a8:b5:dc:2b:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4cf13433ad8784cae053fe51a38643a8b5dc2b3e/; sid:903201615; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"dc:be:92:0e:3d:0c:ba:40:be:80:fb:a5:e2:3a:6b:4f:9a:70:6d:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dcbe920e3d0cba40be80fba5e23a6b4f9a706dd4/; sid:903201616; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"4b:a1:e8:85:5b:47:ce:16:19:e2:ba:ef:19:db:ce:1d:f5:b3:eb:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ba1e8855b47ce1619e2baef19dbce1df5b3eb2c/; sid:903201617; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2e:16:74:f9:28:4d:da:60:a0:b4:83:54:a1:55:17:94:c6:53:b8:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e1674f9284dda60a0b48354a1551794c653b8a8/; sid:903201618; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Sinkhole)"; tls_cert_fingerprint; content:"e0:3e:33:56:29:b8:82:f1:f0:3f:09:11:23:51:1e:aa:3f:c2:d6:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e03e335629b882f1f03f091123511eaa3fc2d6b1/; sid:903201619; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"57:2e:fc:1d:71:cb:6a:49:11:c1:43:93:f1:82:58:57:79:3a:18:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/572efc1d71cb6a4911c14393f1825857793a1869/; sid:903201620; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"5f:cb:5b:41:8f:77:9a:54:2b:71:48:f2:dd:ea:21:14:95:78:77:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fcb5b418f779a542b7148f2ddea211495787733/; sid:903201621; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"2a:5d:84:0b:a9:92:28:08:2b:f7:0a:a8:ae:41:6f:fd:4f:86:80:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a5d840ba99228082bf70aa8ae416ffd4f868051/; sid:903201622; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"6e:03:78:b9:8e:8b:b4:ea:8e:dc:15:4f:2c:82:94:28:70:4a:98:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6e0378b98e8bb4ea8edc154f2c829428704a9839/; sid:903201623; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"9d:86:3f:cb:32:7a:d4:41:18:41:ee:07:13:29:3e:a4:a5:2a:df:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d863fcb327ad4411841ee0713293ea4a52adf95/; sid:903201624; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b6:c3:0a:7e:59:97:39:80:14:cb:b4:1d:0c:5e:ca:44:52:55:54:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6c30a7e5997398014cbb41d0c5eca4452555490/; sid:903201625; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:c4:e1:ee:51:64:ca:3e:d0:18:42:d5:91:e3:9d:c2:64:4e:c0:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06c4e1ee5164ca3ed01842d591e39dc2644ec026/; sid:903201626; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c4:cb:7f:0d:4f:65:8f:71:c3:b1:32:f2:73:06:59:da:60:da:ae:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4cb7f0d4f658f71c3b132f2730659da60daaeac/; sid:903201627; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"77:3b:b1:21:21:46:96:29:41:01:a7:33:18:fe:30:bf:c3:2c:2d:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/773bb121214696294101a73318fe30bfc32c2dcf/; sid:903201628; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0d:ec:05:bb:54:8c:b8:41:2f:83:b4:25:fd:08:22:06:b2:8f:87:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dec05bb548cb8412f83b425fd082206b28f87b5/; sid:903201629; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d9:ee:1e:bc:5d:05:64:7e:9e:57:c9:80:5a:2d:c8:56:5c:5c:60:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9ee1ebc5d05647e9e57c9805a2dc8565c5c60f6/; sid:903201630; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"18:a1:05:f3:f6:2e:52:e2:47:14:49:3e:38:2b:00:b9:30:70:07:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18a105f3f62e52e24714493e382b00b93070077b/; sid:903201631; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"3c:9b:b4:44:80:fa:d3:57:7c:51:6b:21:86:9f:78:4b:10:43:bd:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c9bb44480fad3577c516b21869f784b1043bd21/; sid:903201632; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"8f:2b:e1:bb:91:3b:54:a1:68:c0:39:4a:ff:c6:74:27:2e:da:9e:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f2be1bb913b54a168c0394affc674272eda9eeb/; sid:903201633; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"82:c0:a9:7f:05:88:93:a7:7f:8a:2a:27:bb:75:b5:fb:7a:d2:30:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/82c0a97f058893a77f8a2a27bb75b5fb7ad230ac/; sid:903201634; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c7:01:fa:6c:fe:bc:57:7a:6c:20:f7:74:5c:85:a9:93:85:07:b8:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c701fa6cfebc577a6c20f7745c85a9938507b8a3/; sid:903201635; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"b6:05:c6:66:e1:9d:5d:bc:06:f5:73:a4:1f:35:94:d1:c9:31:fa:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b605c666e19d5dbc06f573a41f3594d1c931faf1/; sid:903201636; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Shifu C&C)"; tls_cert_fingerprint; content:"f7:78:c5:7a:70:3a:49:c5:a5:5f:a1:ad:06:81:00:67:c4:03:fa:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f778c57a703a49c5a55fa1ad06810067c403fae9/; sid:903201637; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"37:32:ab:da:e5:df:b0:59:d9:20:b5:1a:4f:99:f6:54:41:1c:a6:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3732abdae5dfb059d920b51a4f99f654411ca6f7/; sid:903201638; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1e:5e:a2:74:98:84:d3:aa:c8:05:97:9e:ad:d0:e4:5f:98:48:a9:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e5ea2749884d3aac805979eadd0e45f9848a95b/; sid:903201639; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"80:9e:cc:b2:e4:16:b8:27:d4:52:d5:37:93:ec:bf:8c:28:e3:28:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/809eccb2e416b827d452d53793ecbf8c28e32884/; sid:903201640; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c3:06:f5:67:cd:3d:eb:0d:8c:f4:93:f1:b3:e1:47:b9:1f:2e:be:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c306f567cd3deb0d8cf493f1b3e147b91f2ebef3/; sid:903201641; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"38:ef:17:d3:c7:a1:1a:e0:5e:f7:8b:9b:4b:42:df:a1:3b:69:92:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38ef17d3c7a11ae05ef78b9b4b42dfa13b6992b2/; sid:903201642; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2a:a1:c1:bf:cc:8d:4b:6a:04:f2:0f:80:a8:9b:64:19:ea:cf:c5:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2aa1c1bfcc8d4b6a04f20f80a89b6419eacfc50a/; sid:903201643; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ca:de:0e:d9:c0:b0:9a:24:16:94:f9:3e:e5:1b:6f:ac:bc:67:12:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cade0ed9c0b09a241694f93ee51b6facbc671230/; sid:903201644; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware C&C)"; tls_cert_fingerprint; content:"b0:23:8c:54:7a:90:5b:fa:11:9c:4e:8b:ac:ca:ea:cf:36:49:1f:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0238c547a905bfa119c4e8baccaeacf36491ff6/; sid:903201645; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"6f:bc:ae:7b:3f:fa:53:de:f5:21:95:e1:87:36:4a:dc:a0:03:07:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fbcae7b3ffa53def52195e187364adca0030719/; sid:903201646; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"3c:cc:af:27:6c:8f:31:45:2a:9a:44:c8:d2:ae:ea:64:9a:92:b6:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cccaf276c8f31452a9a44c8d2aeea649a92b675/; sid:903201647; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"f4:d0:e0:cf:53:2a:f4:5c:50:2f:64:d1:84:71:ad:76:18:9f:4a:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4d0e0cf532af45c502f64d18471ad76189f4a33/; sid:903201648; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3c:87:5d:a1:4a:71:bc:66:0b:b7:c9:0d:b7:9a:aa:69:c7:6f:d0:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c875da14a71bc660bb7c90db79aaa69c76fd0e0/; sid:903201649; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"63:c6:b8:54:da:a6:b2:ae:7f:35:5d:24:03:f6:e1:28:40:4e:9a:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63c6b854daa6b2ae7f355d2403f6e128404e9a58/; sid:903201650; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"65:38:fb:5f:1e:71:24:85:d2:56:04:0c:21:94:6c:35:d5:1e:62:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6538fb5f1e712485d256040c21946c35d51e6244/; sid:903201651; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:50:84:1f:19:de:dd:73:4b:53:0d:e2:18:57:b9:9d:fe:9d:f0:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3250841f19dedd734b530de21857b99dfe9df057/; sid:903201652; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"0c:f7:10:e3:3d:3e:4a:57:2d:cb:a9:76:3d:92:e6:5b:5d:9c:af:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0cf710e33d3e4a572dcba9763d92e65b5d9caf57/; sid:903201653; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2d:ee:94:1d:f3:dd:2f:65:48:1f:f4:61:8d:cd:15:2f:98:6a:fa:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2dee941df3dd2f65481ff4618dcd152f986afab6/; sid:903201654; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5d:47:e1:02:ad:3a:c8:ff:59:10:aa:41:1c:a5:52:04:82:b4:f0:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d47e102ad3ac8ff5910aa411ca5520482b4f05f/; sid:903201655; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"37:3a:97:ff:16:73:02:9d:1d:af:67:25:37:07:dd:89:d6:1f:2f:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/373a97ff1673029d1daf67253707dd89d61f2f13/; sid:903201656; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"7c:1c:df:ad:43:21:63:48:0d:48:3d:76:63:11:78:61:e7:ee:84:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c1cdfad432163480d483d7663117861e7ee84ad/; sid:903201657; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"6d:5f:3c:c2:2e:17:cd:61:cf:7c:08:22:4d:37:40:cc:34:dd:a8:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d5f3cc22e17cd61cf7c08224d3740cc34dda8a1/; sid:903201658; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"0c:1a:ab:eb:94:f4:35:80:ef:47:b5:b4:3d:94:24:db:1f:f4:66:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c1aabeb94f43580ef47b5b43d9424db1ff4661d/; sid:903201659; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"3e:06:09:e8:75:69:3c:68:a0:7a:da:48:b6:8c:8e:d4:a7:ca:96:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e0609e875693c68a07ada48b68c8ed4a7ca96ef/; sid:903201660; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZeuS C&C)"; tls_cert_fingerprint; content:"0f:a9:4b:03:19:b7:95:2e:80:9e:2f:a0:84:d3:6a:9e:bc:42:8a:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0fa94b0319b7952e809e2fa084d36a9ebc428add/; sid:903201661; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"69:d6:9d:6d:ee:c4:ef:a2:c8:ea:37:69:8d:15:70:b6:a0:3c:ce:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69d69d6deec4efa2c8ea37698d1570b6a03cce0a/; sid:903201662; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"92:75:d5:27:40:c0:b0:1c:e9:52:32:3d:0f:53:68:d7:8a:74:ff:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9275d52740c0b01ce952323d0f5368d78a74ffbf/; sid:903201663; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"98:a6:d6:8d:80:04:05:d0:33:92:10:24:b3:7d:54:51:0c:72:c4:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/98a6d68d800405d033921024b37d54510c72c4ce/; sid:903201664; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"19:8c:4b:58:52:d2:1b:42:5a:cb:05:da:a5:90:d4:09:f3:a5:4a:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/198c4b5852d21b425acb05daa590d409f3a54a65/; sid:903201665; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8a:18:9e:f3:c9:49:c3:8b:a2:38:10:3e:ff:f4:e1:7a:39:b9:c3:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a189ef3c949c38ba238103efff4e17a39b9c3df/; sid:903201666; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"98:4b:3c:4e:f8:3e:14:ed:69:ff:2f:6a:44:63:03:12:71:e6:5a:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/984b3c4ef83e14ed69ff2f6a4463031271e65a86/; sid:903201667; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"2c:8e:d1:0a:08:7b:d1:80:96:46:48:2b:07:43:5b:82:29:79:93:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c8ed10a087bd1809646482b07435b82297993f0/; sid:903201668; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"fd:02:8d:cb:df:0d:f6:9d:70:1f:ca:55:8b:b3:0a:88:48:ad:4f:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd028dcbdf0df69d701fca558bb30a8848ad4f3e/; sid:903201669; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b4:a7:3b:85:43:89:db:e3:5e:ca:2c:c2:a1:ea:7f:63:34:8a:7a:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4a73b854389dbe35eca2cc2a1ea7f63348a7a67/; sid:903201670; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"51:76:d7:ea:82:0b:96:f7:66:b2:3c:17:c3:66:ac:4d:95:0e:37:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5176d7ea820b96f766b23c17c366ac4d950e37c1/; sid:903201671; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"b7:fb:60:58:e5:fc:1d:f0:8a:13:b6:f2:ac:8b:0e:da:4c:a1:a2:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b7fb6058e5fc1df08a13b6f2ac8b0eda4ca1a2db/; sid:903201672; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"37:f7:d3:a0:f5:ac:ac:31:69:e6:df:b0:f0:f9:25:f9:5f:ed:4b:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37f7d3a0f5acac3169e6dfb0f0f925f95fed4be6/; sid:903201673; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Sofacy C&C)"; tls_cert_fingerprint; content:"5b:e5:6e:06:60:a0:01:a1:2c:8e:f2:50:ff:86:36:9c:50:ca:73:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5be56e0660a001a12c8ef250ff86369c50ca73a8/; sid:903201674; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6e:48:d8:f5:76:b1:37:a6:b3:22:88:28:37:0d:77:b2:1e:f8:8a:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6e48d8f576b137a6b3228828370d77b21ef88adc/; sid:903201675; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c4:1f:27:7c:64:95:b2:99:ae:1b:d0:28:a0:a5:7f:c1:7b:60:42:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c41f277c6495b299ae1bd028a0a57fc17b6042de/; sid:903201676; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"25:d2:22:2b:e7:21:91:de:03:cc:da:98:c1:3b:1b:b7:a6:cf:28:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25d2222be72191de03ccda98c13b1bb7a6cf2810/; sid:903201677; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"be:fc:88:84:8e:20:3f:dc:46:5c:0f:ca:03:c3:f6:e4:0e:e4:30:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/befc88848e203fdc465c0fca03c3f6e40ee4305c/; sid:903201678; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"38:dc:61:76:05:65:a7:05:62:59:28:33:b6:76:7e:05:c3:80:1d:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38dc61760565a70562592833b6767e05c3801d95/; sid:903201679; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"91:ca:40:0a:83:6a:85:a3:95:a3:d5:25:ee:96:3c:46:19:ad:4d:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91ca400a836a85a395a3d525ee963c4619ad4dcb/; sid:903201680; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"e2:8d:d9:91:4a:5a:18:e5:c0:83:db:f8:29:1f:01:8f:ab:a0:9f:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e28dd9914a5a18e5c083dbf8291f018faba09fc0/; sid:903201681; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"3b:a9:31:86:86:32:7d:79:38:34:f1:65:96:4b:bd:6e:35:4a:a7:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ba9318686327d793834f165964bbd6e354aa74d/; sid:903201682; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"14:2e:f2:14:dc:ac:d7:83:83:d8:6f:20:a9:91:e5:39:a6:2c:90:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/142ef214dcacd78383d86f20a991e539a62c90ca/; sid:903201683; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"49:64:a6:d2:e8:76:a5:ad:c3:76:9d:92:98:f5:c0:77:14:09:1c:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4964a6d2e876a5adc3769d9298f5c07714091cf1/; sid:903201684; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8b:c2:66:f7:bb:f4:24:48:e8:7c:bf:f1:56:7a:65:e6:08:47:df:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8bc266f7bbf42448e87cbff1567a65e60847df34/; sid:903201685; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"90:1f:02:c2:5e:05:08:88:41:49:ce:a2:77:71:70:28:da:2f:a6:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/901f02c25e0508884149cea277717028da2fa6ce/; sid:903201686; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2b:bf:93:89:f2:b6:25:b4:6d:74:77:55:c9:e1:f0:c3:31:fa:37:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2bbf9389f2b625b46d747755c9e1f0c331fa377c/; sid:903201687; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"28:59:46:b1:5d:55:b9:7c:25:ee:cf:fa:22:bc:2e:42:47:ab:40:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/285946b15d55b97c25eecffa22bc2e4247ab405d/; sid:903201688; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6a:c0:57:18:a0:ab:32:b0:c5:df:21:9a:df:81:0a:c4:cf:c7:70:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ac05718a0ab32b0c5df219adf810ac4cfc77083/; sid:903201689; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:f4:c2:03:81:01:23:11:56:b0:59:3f:e2:0a:40:e3:13:27:5a:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cef4c2038101231156b0593fe20a40e313275a07/; sid:903201690; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"97:14:2a:b7:ff:13:0a:3d:fc:8c:b5:7d:e1:a1:f2:a0:15:93:c4:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97142ab7ff130a3dfc8cb57de1a1f2a01593c42b/; sid:903201691; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"4e:0c:78:38:5e:ab:da:e8:ec:84:32:9f:ee:83:8d:44:6c:2b:ea:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e0c78385eabdae8ec84329fee838d446c2bea08/; sid:903201692; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"36:4b:89:17:a3:e1:af:ca:07:96:d0:2d:43:84:fd:57:41:cd:95:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/364b8917a3e1afca0796d02d4384fd5741cd9593/; sid:903201693; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"1f:0e:dd:ff:31:74:fe:3e:bc:fa:4c:62:5f:e9:f6:19:a5:8e:28:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f0eddff3174fe3ebcfa4c625fe9f619a58e282e/; sid:903201694; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"fc:7f:30:ca:d7:f6:06:e5:21:20:16:a3:58:cf:1d:ce:d3:f7:9c:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc7f30cad7f606e5212016a358cf1dced3f79c5e/; sid:903201695; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"23:5b:67:3c:f7:50:b7:5b:97:1b:45:c8:67:f1:f6:aa:23:c5:84:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/235b673cf750b75b971b45c867f1f6aa23c584ac/; sid:903201696; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"60:60:70:e1:72:11:79:ad:fc:c7:d2:a9:ca:96:b8:ac:d6:f0:20:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/606070e1721179adfcc7d2a9ca96b8acd6f02049/; sid:903201697; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"7f:9b:36:d5:67:8b:a5:c7:eb:1a:1a:c4:f1:ff:59:e1:00:46:a6:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f9b36d5678ba5c7eb1a1ac4f1ff59e10046a674/; sid:903201698; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Tuhkit C&C)"; tls_cert_fingerprint; content:"0c:6d:37:21:e9:b4:ba:3b:ba:c4:61:7b:34:f0:f0:ff:75:f8:8e:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c6d3721e9b4ba3bbac4617b34f0f0ff75f88e72/; sid:903201699; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:c2:3a:77:81:77:2d:9f:9d:f9:5d:ae:22:cf:3a:a2:d1:82:0a:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a3c23a7781772d9f9df95dae22cf3aa2d1820aab/; sid:903201700; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d2:12:e2:65:14:30:19:23:dd:7e:cb:b5:6e:eb:8f:a5:c5:27:74:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d212e26514301923dd7ecbb56eeb8fa5c5277478/; sid:903201701; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b6:04:c8:21:ae:0f:81:ab:9b:0e:9f:c4:31:8d:b5:e0:92:20:20:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b604c821ae0f81ab9b0e9fc4318db5e09220204e/; sid:903201702; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"8b:14:04:4f:38:67:41:50:ab:70:e8:74:4f:1d:cd:03:9a:9c:40:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b14044f38674150ab70e8744f1dcd039a9c4098/; sid:903201703; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Flokibot C&C)"; tls_cert_fingerprint; content:"a8:0f:80:72:47:22:cd:77:4b:80:38:8f:4b:85:3e:c5:d4:27:0e:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a80f80724722cd774b80388f4b853ec5d4270ef3/; sid:903201704; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2d:e8:c1:99:00:14:0c:e5:ee:9e:82:44:7d:00:8e:69:cb:dc:8f:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2de8c19900140ce5ee9e82447d008e69cbdc8f8e/; sid:903201705; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"93:0b:e3:26:b1:33:5b:0c:e8:3f:0b:2d:60:39:10:09:c9:d4:46:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/930be326b1335b0ce83f0b2d60391009c9d44684/; sid:903201706; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"c1:3f:38:a3:85:f2:37:97:8e:77:93:ae:92:8b:45:ba:e5:c9:3d:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c13f38a385f237978e7793ae928b45bae5c93d58/; sid:903201707; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"d2:07:43:87:b1:d9:75:fe:52:55:f5:28:5e:1c:75:4d:95:09:5a:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2074387b1d975fe5255f5285e1c754d95095a24/; sid:903201708; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"91:e0:5e:f0:66:3b:df:d9:69:3a:5c:68:73:5a:4b:7b:e1:3c:94:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91e05ef0663bdfd9693a5c68735a4b7be13c941e/; sid:903201709; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"1e:ef:63:b9:1a:fa:ad:d5:a5:10:cf:b6:7d:3d:1e:a3:3a:f1:8c:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1eef63b91afaadd5a510cfb67d3d1ea33af18c49/; sid:903201710; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:1c:66:be:0e:b4:5d:10:62:7f:af:8d:c3:86:83:00:c3:07:93:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/371c66be0eb45d10627faf8dc3868300c30793ed/; sid:903201711; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"c3:d4:ae:f8:80:95:19:b1:40:77:ad:b7:0f:7b:52:0b:85:33:d5:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3d4aef8809519b14077adb70f7b520b8533d569/; sid:903201712; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Flokibot C&C)"; tls_cert_fingerprint; content:"b7:a4:74:3e:88:56:75:b9:ac:54:f7:3b:42:17:ef:60:da:84:f7:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b7a4743e885675b9ac54f73b4217ef60da84f73a/; sid:903201713; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"d1:25:06:37:88:10:7c:42:75:be:9f:ad:e6:97:bf:03:1f:31:90:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d125063788107c4275be9fade697bf031f3190ee/; sid:903201714; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c8:bf:c4:45:d1:33:d9:c3:a6:e4:60:6f:10:5e:0d:d8:b1:99:48:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8bfc445d133d9c3a6e4606f105e0dd8b19948a3/; sid:903201715; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"26:f2:61:5d:18:e3:90:0b:1a:72:b4:1e:a5:5b:8c:20:ef:7b:da:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26f2615d18e3900b1a72b41ea55b8c20ef7bda66/; sid:903201716; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"bf:1d:af:81:ab:7b:c7:a1:53:ce:ef:91:1c:09:5e:dc:3f:ba:fc:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf1daf81ab7bc7a153ceef911c095edc3fbafc99/; sid:903201717; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:31:c7:07:fe:04:2f:ff:0d:cb:55:3e:af:27:03:9f:1c:dd:b7:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce31c707fe042fff0dcb553eaf27039f1cddb7e6/; sid:903201718; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3b:76:3c:d8:d1:96:1e:a9:85:d5:bb:88:4a:ef:f6:6e:51:e6:2a:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b763cd8d1961ea985d5bb884aeff66e51e62a40/; sid:903201719; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"53:81:ad:cf:3c:17:b7:f8:62:28:1a:5a:08:92:06:92:e5:0c:45:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5381adcf3c17b7f862281a5a08920692e50c45f4/; sid:903201720; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"a8:a1:19:83:27:02:69:1a:b0:a7:b0:fc:6a:42:42:7a:a2:97:d7:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a8a119832702691ab0a7b0fc6a42427aa297d748/; sid:903201721; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"15:92:d6:bd:7a:96:77:d4:b6:b3:30:68:e5:3f:ad:ea:15:f8:c7:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1592d6bd7a9677d4b6b33068e53fadea15f8c793/; sid:903201722; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"12:10:c3:32:4a:06:74:48:d4:7a:d1:98:08:4d:7a:04:b1:5f:bb:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1210c3324a067448d47ad198084d7a04b15fbb39/; sid:903201723; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c6:11:65:5c:84:ac:07:49:bd:81:05:ea:3d:ec:1f:4c:df:14:8f:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c611655c84ac0749bd8105ea3dec1f4cdf148fb5/; sid:903201724; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c4:d6:08:de:17:a8:57:69:ed:a8:b3:ae:b3:ad:ea:6a:58:f2:11:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4d608de17a85769eda8b3aeb3adea6a58f21107/; sid:903201725; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"7c:fe:27:5c:ea:e4:24:5c:73:e0:87:63:12:4d:17:cc:aa:19:bf:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7cfe275ceae4245c73e08763124d17ccaa19bf44/; sid:903201726; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"37:f5:ca:ec:69:16:96:5a:7f:9c:2a:4d:26:22:33:4a:e5:f1:4c:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37f5caec6916965a7f9c2a4d2622334ae5f14c3a/; sid:903201727; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:a7:dc:38:b9:0f:71:8d:3b:34:ea:0f:c6:be:c3:9c:8f:2f:7a:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a3a7dc38b90f718d3b34ea0fc6bec39c8f2f7a8c/; sid:903201728; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:5c:84:f8:db:f9:df:c1:92:38:38:13:70:1b:f1:ca:f8:27:fd:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/435c84f8dbf9dfc192383813701bf1caf827fdbf/; sid:903201729; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"92:42:3f:82:4a:66:6d:95:b1:2e:63:a5:6e:fd:e3:cc:c1:ae:7f:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92423f824a666d95b12e63a56efde3ccc1ae7fc7/; sid:903201730; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"31:53:36:e7:51:3e:ba:5b:06:73:64:95:ca:bc:cc:e9:4c:58:f8:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/315336e7513eba5b06736495cabccce94c58f8d0/; sid:903201731; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"83:17:a8:5e:af:39:ec:5a:6f:03:80:a3:b9:74:4b:8e:3f:f3:ab:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8317a85eaf39ec5a6f0380a3b9744b8e3ff3abe6/; sid:903201732; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"04:bb:ff:19:be:2e:b0:8c:b7:0d:02:f1:3c:0a:36:0c:71:6a:81:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/04bbff19be2eb08cb70d02f13c0a360c716a8196/; sid:903201733; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"37:83:0c:93:5a:7d:ba:47:51:3e:24:b5:79:2b:de:cb:fa:df:2a:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37830c935a7dba47513e24b5792bdecbfadf2a73/; sid:903201734; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"1d:99:bb:47:24:51:4e:2a:87:f5:dd:de:8c:81:a8:03:c5:04:ac:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d99bb4724514e2a87f5ddde8c81a803c504accf/; sid:903201735; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"e1:8d:a4:f1:48:05:8c:77:70:37:01:92:fc:f0:c9:e1:81:00:c7:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e18da4f148058c7770370192fcf0c9e18100c79e/; sid:903201736; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"0f:07:3d:24:a6:76:37:f4:27:e7:4b:2f:a1:ff:5b:bc:42:c4:c1:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f073d24a67637f427e74b2fa1ff5bbc42c4c157/; sid:903201737; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"5d:40:6e:44:b8:90:d6:85:5c:44:fa:e3:88:bc:a3:bd:82:8a:c7:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d406e44b890d6855c44fae388bca3bd828ac7ff/; sid:903201738; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c3:e1:7e:de:e4:98:6c:b6:3b:be:d8:57:20:c9:4e:0f:a2:84:10:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3e17edee4986cb63bbed85720c94e0fa2841011/; sid:903201739; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"42:73:d1:03:c5:fe:c2:ed:e6:f9:ca:d0:92:a8:34:17:a4:3f:e7:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4273d103c5fec2ede6f9cad092a83417a43fe741/; sid:903201740; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"f4:57:07:8a:ca:7b:2b:93:6f:2a:91:87:0c:77:29:ae:d6:13:fb:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f457078aca7b2b936f2a91870c7729aed613fb80/; sid:903201741; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"06:52:9c:2f:d2:41:d9:05:ab:19:df:a0:fa:75:8d:51:95:0e:3c:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06529c2fd241d905ab19dfa0fa758d51950e3c35/; sid:903201742; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"69:9a:e2:9f:d3:0a:77:23:a6:96:57:8b:4b:8f:fe:08:9e:ad:8e:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/699ae29fd30a7723a696578b4b8ffe089ead8e9b/; sid:903201743; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0a:c6:ec:94:53:c6:87:b1:83:69:7c:cc:b8:41:55:d1:46:99:c5:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ac6ec9453c687b183697cccb84155d14699c513/; sid:903201744; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"34:6f:f7:29:94:50:45:49:d5:3f:73:37:34:dc:5d:f3:88:17:18:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/346ff72994504549d53f733734dc5df3881718a0/; sid:903201745; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"68:de:c5:1d:9d:27:fd:d6:ef:c5:7b:b5:58:1b:54:24:3f:b6:0a:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68dec51d9d27fdd6efc57bb5581b54243fb60aeb/; sid:903201746; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"82:a3:4d:b6:eb:6f:1f:a2:d6:38:3f:f0:d2:67:5f:09:6b:a6:bc:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/82a34db6eb6f1fa2d6383ff0d2675f096ba6bc1b/; sid:903201747; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ce:c3:a8:ff:a8:61:ca:55:6f:cc:59:04:72:ac:b8:c8:04:65:b0:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cec3a8ffa861ca556fcc590472acb8c80465b0f5/; sid:903201748; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:29:5c:b4:4d:4d:41:53:75:26:f8:c6:eb:ca:ca:e1:eb:d4:3d:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15295cb44d4d41537526f8c6ebcacae1ebd43d4b/; sid:903201749; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"dc:44:1e:d1:e1:33:5b:90:45:1c:cd:04:6b:83:73:e7:3a:fc:b0:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc441ed1e1335b90451ccd046b8373e73afcb097/; sid:903201750; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8e:ef:8e:5d:51:19:d2:3d:25:92:64:48:5f:ce:70:6d:f2:41:1e:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8eef8e5d5119d23d259264485fce706df2411e52/; sid:903201751; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"4f:fa:b6:86:3c:c3:7f:a2:bd:b1:b6:44:96:ad:ec:45:61:07:04:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ffab6863cc37fa2bdb1b64496adec4561070472/; sid:903201752; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"03:a9:c8:bd:3e:09:2e:f8:73:1d:b9:8e:c0:fa:3e:b6:df:83:8b:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/03a9c8bd3e092ef8731db98ec0fa3eb6df838b08/; sid:903201753; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"07:99:fa:be:78:85:88:13:7e:90:f0:82:8d:06:b5:34:32:69:ab:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0799fabe788588137e90f0828d06b5343269abe4/; sid:903201754; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b5:ad:8c:78:3c:57:ef:bd:67:64:91:a5:d2:d7:a8:63:16:3d:9e:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5ad8c783c57efbd676491a5d2d7a863163d9e14/; sid:903201755; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"06:07:2c:50:f1:31:ca:75:79:9c:b5:57:26:b2:89:ce:35:c0:d0:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06072c50f131ca75799cb55726b289ce35c0d048/; sid:903201756; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bf:d5:80:57:41:97:75:1e:f6:39:21:b5:9c:9a:7c:af:f1:43:06:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bfd580574197751ef63921b59c9a7caff14306c5/; sid:903201757; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d4:96:42:2a:79:34:df:51:3c:16:83:84:4c:8a:68:69:e6:46:2f:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d496422a7934df513c1683844c8a6869e6462f6f/; sid:903201758; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"10:71:d0:60:d0:c1:25:7a:33:fb:fd:9b:83:de:c0:ab:30:43:6e:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1071d060d0c1257a33fbfd9b83dec0ab30436e04/; sid:903201759; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Vawtrak C&C)"; tls_cert_fingerprint; content:"d4:f3:ef:1b:ef:3d:14:0a:d9:1e:83:c1:8a:af:28:ad:3a:c8:79:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4f3ef1bef3d140ad91e83c18aaf28ad3ac87980/; sid:903201760; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"62:bd:b4:04:03:8f:4d:32:a7:51:99:d7:ac:01:d0:91:bb:e4:46:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62bdb404038f4d32a75199d7ac01d091bbe446e2/; sid:903201761; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9c:31:42:02:20:91:7a:09:fa:3f:26:ce:82:6c:83:da:3d:c3:d4:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c31420220917a09fa3f26ce826c83da3dc3d409/; sid:903201762; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c5:03:6f:5e:25:b1:9c:8d:37:6e:17:52:83:50:0b:bc:e4:a4:d1:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c5036f5e25b19c8d376e175283500bbce4a4d19a/; sid:903201763; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a8:2d:d2:58:54:4a:cf:0a:10:92:96:49:34:21:26:23:97:74:1d:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a82dd258544acf0a109296493421262397741db7/; sid:903201764; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1d:05:c6:fe:f1:4d:26:71:d7:59:a0:5b:49:64:64:b8:31:c6:50:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d05c6fef14d2671d759a05b496464b831c650e8/; sid:903201765; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"7b:72:31:6f:e4:a9:06:9c:8b:4f:97:3d:bb:28:68:f1:b9:e9:fa:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b72316fe4a9069c8b4f973dbb2868f1b9e9fa63/; sid:903201766; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"38:d5:0b:e8:83:1f:4a:2a:e9:31:dd:31:56:a8:cd:8e:12:17:bd:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38d50be8831f4a2ae931dd3156a8cd8e1217bd53/; sid:903201767; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3d:b0:61:1a:bf:b1:9d:1b:fe:5e:28:35:ba:d8:85:4a:50:e9:28:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3db0611abfb19d1bfe5e2835bad8854a50e928b0/; sid:903201768; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"eb:98:f0:0e:43:e7:a1:32:e5:3f:5a:2d:03:20:8d:47:58:e4:0b:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb98f00e43e7a132e53f5a2d03208d4758e40b56/; sid:903201769; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"52:70:99:bd:97:e1:c8:e8:77:09:13:78:06:6e:91:8b:15:63:ef:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/527099bd97e1c8e877091378066e918b1563ef8d/; sid:903201770; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:0f:88:7a:4a:f0:19:4e:b5:81:d5:60:80:a3:ba:bf:bc:1d:12:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/450f887a4af0194eb581d56080a3babfbc1d12b4/; sid:903201771; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"81:c6:eb:5c:91:7e:43:01:cc:81:84:0c:74:93:8e:92:07:bc:ce:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/81c6eb5c917e4301cc81840c74938e9207bccee6/; sid:903201772; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:0e:4f:80:38:bf:48:3a:f1:74:9e:7e:bc:5a:21:7a:4b:bd:43:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d0e4f8038bf483af1749e7ebc5a217a4bbd43e0/; sid:903201773; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2d:2b:f3:24:d7:f3:52:d9:e6:d4:9b:b0:d9:6e:05:19:6d:f7:93:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2d2bf324d7f352d9e6d49bb0d96e05196df793cc/; sid:903201774; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"ec:21:cd:3a:9b:2d:4a:0a:5d:c6:d1:8c:71:4b:f4:ea:b9:22:13:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec21cd3a9b2d4a0a5dc6d18c714bf4eab92213d2/; sid:903201775; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"21:a1:c4:b9:7d:84:ec:d3:eb:69:50:c1:b9:f0:31:35:71:9e:5d:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/21a1c4b97d84ecd3eb6950c1b9f03135719e5dc0/; sid:903201776; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"57:60:00:86:f4:46:f8:93:b9:98:52:b7:e1:95:2c:f8:97:9f:fd:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/57600086f446f893b99852b7e1952cf8979ffd4b/; sid:903201777; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"79:6a:99:bc:9f:7d:b3:1a:cd:d4:8b:5a:76:1f:70:b3:b2:17:0b:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/796a99bc9f7db31acdd48b5a761f70b3b2170bf9/; sid:903201778; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"db:24:81:4f:76:47:f9:15:71:9b:06:c4:bc:d7:d9:63:82:2f:d5:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db24814f7647f915719b06c4bcd7d963822fd507/; sid:903201779; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"89:f7:0f:43:f5:d8:1a:48:f4:8a:cd:5c:de:c9:d3:7f:d8:a0:4b:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89f70f43f5d81a48f48acd5cdec9d37fd8a04bba/; sid:903201780; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"cf:7a:4a:22:21:b0:3e:c1:e6:04:96:22:3b:8c:85:ce:32:ab:ed:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf7a4a2221b03ec1e60496223b8c85ce32abede6/; sid:903201781; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b4:a9:29:48:18:89:8d:84:95:aa:53:9f:07:9d:7a:78:80:01:07:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4a9294818898d8495aa539f079d7a78800107fa/; sid:903201782; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"df:f9:91:d6:d9:b0:c9:47:27:2b:b3:d7:80:0b:41:77:be:49:2f:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dff991d6d9b0c947272bb3d7800b4177be492f91/; sid:903201783; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"43:85:58:04:f0:a4:2b:76:ed:90:57:b8:20:92:80:f7:56:f5:36:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43855804f0a42b76ed9057b8209280f756f536ee/; sid:903201784; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a9:7b:76:16:d3:cf:e7:fe:c8:4f:27:0d:15:cd:d1:49:d3:0e:cd:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a97b7616d3cfe7fec84f270d15cdd149d30ecdc6/; sid:903201785; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6f:4b:b2:5c:c3:6d:1c:bd:f5:35:d0:6f:4b:3e:d4:e4:5b:ab:bd:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f4bb25cc36d1cbdf535d06f4b3ed4e45babbdd4/; sid:903201786; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7a:03:a2:d9:f0:cf:40:5c:d3:ec:2b:1a:10:e2:6a:a1:b6:36:57:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a03a2d9f0cf405cd3ec2b1a10e26aa1b63657b1/; sid:903201787; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"45:35:bf:9a:e7:e7:86:d7:7e:e4:82:d7:4b:9a:22:cb:e0:99:be:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4535bf9ae7e786d77ee482d74b9a22cbe099be2e/; sid:903201788; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrrentLocker C&C)"; tls_cert_fingerprint; content:"1b:43:bb:82:f2:fe:80:e5:ce:f4:de:6e:4b:31:7f:ff:51:ba:83:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b43bb82f2fe80e5cef4de6e4b317fff51ba83b7/; sid:903201789; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b3:8a:86:55:ec:b5:69:de:29:43:4a:e8:c7:b1:87:c9:3b:84:b6:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b38a8655ecb569de29434ae8c7b187c93b84b606/; sid:903201790; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9e:93:5b:1f:30:af:15:da:28:0d:e0:99:ec:72:58:97:8b:69:c7:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e935b1f30af15da280de099ec7258978b69c756/; sid:903201791; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d9:23:2a:ef:f9:e8:23:a4:d8:c3:dc:77:67:4a:6b:dd:88:ed:6e:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9232aeff9e823a4d8c3dc77674a6bdd88ed6e9b/; sid:903201792; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"74:8e:31:8f:08:23:28:d0:5e:1a:e6:8b:88:e5:13:9f:fa:73:4b:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/748e318f082328d05e1ae68b88e5139ffa734b5a/; sid:903201793; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"db:f0:33:7b:21:43:6f:b6:2e:6e:79:e8:88:bd:d9:0f:26:68:b3:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbf0337b21436fb62e6e79e888bdd90f2668b31f/; sid:903201794; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d8:eb:24:f9:08:48:87:2f:db:ec:a3:9d:b3:4b:e1:00:4f:1b:03:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8eb24f90848872fdbeca39db34be1004f1b030d/; sid:903201795; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"2b:00:84:c8:89:c0:17:a7:07:4a:09:b5:bb:6e:58:e4:d7:50:dd:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b0084c889c017a7074a09b5bb6e58e4d750dde7/; sid:903201796; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"66:9f:16:d4:38:46:94:2f:01:1f:d1:52:56:2f:db:1f:62:f3:ff:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/669f16d43846942f011fd152562fdb1f62f3ffb8/; sid:903201797; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"1b:1e:ed:d1:9f:9f:11:33:7e:ba:e2:8a:03:c4:a9:d6:60:ee:b3:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b1eedd19f9f11337ebae28a03c4a9d660eeb3a8/; sid:903201798; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"9b:a5:9e:04:a7:c8:be:3d:94:02:5d:53:19:16:0d:9c:f0:16:a8:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ba59e04a7c8be3d94025d5319160d9cf016a843/; sid:903201799; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4e:1c:98:bd:26:40:f3:ac:8e:1c:9a:b2:0c:b8:35:bd:33:b7:9d:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e1c98bd2640f3ac8e1c9ab20cb835bd33b79da1/; sid:903201800; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7e:17:89:fa:7e:4d:34:69:80:c1:15:7e:ea:cc:0d:49:2d:d5:be:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e1789fa7e4d346980c1157eeacc0d492dd5bea4/; sid:903201801; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"cd:48:bd:25:00:3a:23:33:87:c6:a3:99:1d:94:74:da:d3:64:ca:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd48bd25003a233387c6a3991d9474dad364ca9a/; sid:903201802; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"1f:20:93:d3:3c:6a:aa:0f:1e:93:65:99:1f:37:cc:27:62:3e:2c:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f2093d33c6aaa0f1e9365991f37cc27623e2cf7/; sid:903201803; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3b:a9:d8:29:ac:97:f9:29:db:1a:55:90:d0:1f:29:03:06:7e:0b:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ba9d829ac97f929db1a5590d01f2903067e0bb5/; sid:903201804; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1d:1b:4f:67:f0:70:df:5c:ae:8f:39:55:39:78:f0:ad:b3:ab:d0:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d1b4f67f070df5cae8f39553978f0adb3abd0c0/; sid:903201805; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"bc:2a:55:d2:bc:b8:c1:f7:ae:75:58:01:d8:b0:70:90:34:14:4e:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc2a55d2bcb8c1f7ae755801d8b0709034144ece/; sid:903201806; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6c:e3:74:01:40:12:8c:f5:50:0b:56:e1:b5:02:0b:c2:2d:e6:47:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ce3740140128cf5500b56e1b5020bc22de647a1/; sid:903201807; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"7c:03:62:46:3c:c2:bb:dd:16:b9:d2:e2:46:f0:e4:48:9b:1f:c3:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c0362463cc2bbdd16b9d2e246f0e4489b1fc3b7/; sid:903201808; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:a5:8a:8a:db:fc:e0:80:7e:8e:1e:be:8f:54:31:97:98:ec:17:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5da58a8adbfce0807e8e1ebe8f54319798ec174e/; sid:903201809; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"34:6e:1b:a0:00:e1:a9:1f:b5:a1:db:b9:7f:fe:aa:1d:de:41:2c:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/346e1ba000e1a91fb5a1dbb97ffeaa1dde412c5f/; sid:903201810; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"aa:1e:69:d1:3f:c1:90:b5:91:7e:f6:9f:a1:ab:f3:86:3f:21:15:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa1e69d13fc190b5917ef69fa1abf3863f2115aa/; sid:903201811; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"46:bd:7b:b0:ee:db:1b:0e:05:52:30:ee:b7:6e:d1:df:db:41:da:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46bd7bb0eedb1b0e055230eeb76ed1dfdb41dafc/; sid:903201812; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"cc:09:f3:54:23:a1:c1:08:c9:92:85:4f:ab:1f:b7:7f:44:75:57:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cc09f35423a1c108c992854fab1fb77f44755782/; sid:903201813; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"21:26:96:55:07:eb:de:32:5e:1b:c4:2c:a1:4d:3d:1f:68:1b:96:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2126965507ebde325e1bc42ca14d3d1f681b96eb/; sid:903201814; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ba:6c:97:97:22:1f:84:1e:9f:48:8b:cc:2e:d0:80:59:39:70:91:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba6c9797221f841e9f488bcc2ed08059397091bf/; sid:903201815; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"66:e8:7d:1e:55:9f:4c:28:c4:5c:ef:85:2f:74:d1:37:21:2a:0e:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66e87d1e559f4c28c45cef852f74d137212a0e6f/; sid:903201816; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"b0:93:d2:ee:30:4e:e3:f3:aa:7b:3e:ac:7a:84:8f:ce:0e:4b:90:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b093d2ee304ee3f3aa7b3eac7a848fce0e4b9095/; sid:903201817; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"93:5c:76:42:6a:91:f4:bc:38:a0:f8:76:b5:3b:0b:c2:7a:57:ba:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/935c76426a91f4bc38a0f876b53b0bc27a57ba83/; sid:903201818; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"ab:f5:ce:4f:1c:12:52:57:60:01:59:68:18:25:15:2a:8a:e8:7e:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/abf5ce4f1c125257600159681825152a8ae87e1b/; sid:903201819; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"88:87:30:fb:84:c1:1d:d0:ae:ff:49:99:10:4b:47:79:a8:f6:de:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/888730fb84c11dd0aeff4999104b4779a8f6deb0/; sid:903201820; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"41:a1:80:cf:b9:e2:ec:1b:70:9d:2f:e8:c6:2d:cf:5a:7e:8c:91:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/41a180cfb9e2ec1b709d2fe8c62dcf5a7e8c911e/; sid:903201821; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"51:22:63:41:62:40:f6:64:f5:b6:c8:e7:65:49:8c:0f:fd:45:72:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/512263416240f664f5b6c8e765498c0ffd45729e/; sid:903201822; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"53:ba:46:ad:70:66:2e:1d:3e:eb:ce:45:4c:d4:06:25:12:f7:17:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53ba46ad70662e1d3eebce454cd4062512f717c8/; sid:903201823; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1f:ca:c1:c0:39:dd:9d:d5:8a:4b:93:3c:aa:03:4a:7a:91:39:17:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fcac1c039dd9dd58a4b933caa034a7a91391700/; sid:903201824; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ff:10:a4:06:af:a6:97:ce:b6:0c:a2:ac:74:3e:bb:92:8d:5e:dd:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff10a406afa697ceb60ca2ac743ebb928d5eddf7/; sid:903201825; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a9:f9:2a:27:81:22:c9:2d:17:ae:ed:fc:e5:2c:7f:57:d4:cc:95:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9f92a278122c92d17aeedfce52c7f57d4cc95b7/; sid:903201826; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a7:6d:bf:aa:e1:46:43:7a:13:66:b5:a3:2d:59:95:94:8e:63:00:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a76dbfaae146437a1366b5a32d5995948e6300d1/; sid:903201827; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"be:69:17:86:56:4d:72:46:b3:ba:95:63:e8:e9:62:06:41:c3:63:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be691786564d7246b3ba9563e8e9620641c363c4/; sid:903201828; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"73:2b:c4:31:d9:d4:22:40:1c:18:53:70:f4:81:cc:2c:eb:9d:83:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/732bc431d9d422401c185370f481cc2ceb9d8326/; sid:903201829; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"62:db:4d:ed:d0:8c:62:9e:af:d8:dd:93:bf:4b:37:7a:61:f4:6c:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62db4dedd08c629eafd8dd93bf4b377a61f46c8e/; sid:903201830; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"43:9b:32:93:4a:b5:96:dd:ce:f4:7a:b1:3b:bc:d5:1a:1b:26:98:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/439b32934ab596ddcef47ab13bbcd51a1b269896/; sid:903201831; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e6:d8:37:21:4a:81:81:76:71:1a:61:64:6b:db:39:aa:02:32:86:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e6d837214a818176711a61646bdb39aa02328644/; sid:903201832; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5a:4e:01:e0:ce:a5:83:94:c6:4b:ce:65:a7:e3:ef:28:53:14:65:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5a4e01e0cea58394c64bce65a7e3ef28531465d1/; sid:903201833; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"df:a5:4f:6e:30:78:09:8e:4c:d6:e3:20:30:37:98:f2:7a:64:00:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfa54f6e3078098e4cd6e320303798f27a640096/; sid:903201834; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"37:4c:24:ce:ee:92:08:a1:88:1b:73:36:7a:d2:41:46:ec:8c:23:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/374c24ceee9208a1881b73367ad24146ec8c23bb/; sid:903201835; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"02:32:2f:13:4d:1c:4d:43:e7:f9:05:cc:bb:25:43:1b:a9:7e:0c:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02322f134d1c4d43e7f905ccbb25431ba97e0cb8/; sid:903201836; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"85:1a:e0:21:34:4b:31:ea:a0:81:50:b7:fa:a1:5a:57:fc:b1:55:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/851ae021344b31eaa08150b7faa15a57fcb155c3/; sid:903201837; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"34:76:6e:3b:5a:53:ea:03:9d:0d:7b:f6:44:69:45:14:03:4c:26:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34766e3b5a53ea039d0d7bf644694514034c26aa/; sid:903201838; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a1:e6:cc:33:a4:a9:57:f2:f2:21:02:98:38:88:60:16:4d:c0:84:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a1e6cc33a4a957f2f2210298388860164dc08404/; sid:903201839; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"af:01:a8:59:ba:00:dc:ed:9e:a6:1a:e5:37:bf:b4:cb:5d:3d:eb:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af01a859ba00dced9ea61ae537bfb4cb5d3deb0a/; sid:903201840; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d9:59:2d:62:46:c3:2f:60:09:68:91:f0:66:65:3c:87:d6:14:19:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9592d6246c32f60096891f066653c87d614199c/; sid:903201841; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1e:91:be:5b:b2:22:34:bd:19:ce:a3:d2:ec:8b:7f:f1:c1:9c:be:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e91be5bb22234bd19cea3d2ec8b7ff1c19cbe37/; sid:903201842; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"00:09:a6:6e:ab:25:c8:1f:94:0e:1c:83:24:d8:48:28:6d:91:e0:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0009a66eab25c81f940e1c8324d848286d91e015/; sid:903201843; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"10:1b:0f:5b:4f:4e:33:6a:2e:9c:c8:2b:8e:00:d3:97:f4:93:9e:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/101b0f5b4f4e336a2e9cc82b8e00d397f4939e6b/; sid:903201844; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ff:ff:89:55:e7:62:ca:a2:7b:97:a2:2e:2c:6f:e6:d0:53:a8:f1:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ffff8955e762caa27b97a22e2c6fe6d053a8f19a/; sid:903201845; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"41:32:66:2a:da:64:a2:9d:65:00:55:78:c9:de:1c:6e:05:d6:23:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4132662ada64a29d65005578c9de1c6e05d62378/; sid:903201846; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d2:a5:1b:61:a3:22:77:df:a6:1d:49:4d:c2:06:54:67:5f:ee:f4:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2a51b61a32277dfa61d494dc20654675feef47f/; sid:903201847; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"20:7a:20:9e:4b:7a:56:51:40:5a:f7:80:ed:c2:40:6e:b0:bf:b6:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/207a209e4b7a5651405af780edc2406eb0bfb658/; sid:903201848; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4c:27:cd:56:4b:05:48:61:19:e4:7e:c2:99:f4:76:c0:f9:f0:db:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c27cd564b05486119e47ec299f476c0f9f0dbfd/; sid:903201849; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"47:77:bf:5f:0d:e5:7f:cf:a0:b0:e1:8a:72:8a:86:95:7b:99:86:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4777bf5f0de57fcfa0b0e18a728a86957b99863c/; sid:903201850; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"75:84:b6:d8:52:87:12:da:45:bd:cf:94:e1:60:fc:d8:94:a5:9b:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7584b6d8528712da45bdcf94e160fcd894a59b7b/; sid:903201851; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"11:e6:83:57:b3:e0:88:a3:70:8f:1b:64:cf:8d:a3:01:74:88:b3:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11e68357b3e088a3708f1b64cf8da3017488b379/; sid:903201852; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"cd:25:6e:fa:c6:80:9f:14:bb:84:c3:90:a8:98:19:c0:82:2c:24:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd256efac6809f14bb84c390a89819c0822c24a2/; sid:903201853; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"53:ea:66:43:ef:eb:0f:3f:88:ac:de:34:59:d9:5d:95:15:d8:d6:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53ea6643efeb0f3f88acde3459d95d9515d8d6f8/; sid:903201854; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ca:17:e7:0b:72:90:44:5d:04:9d:9f:53:89:76:e4:fa:d8:f8:72:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca17e70b7290445d049d9f538976e4fad8f872a0/; sid:903201855; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"5d:23:1b:d1:88:44:18:09:ea:b3:4d:25:e0:90:4f:0c:31:e8:24:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d231bd188441809eab34d25e0904f0c31e82452/; sid:903201856; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"ed:76:6b:75:7f:be:f9:bf:96:5d:f3:eb:98:12:3e:bf:a1:7e:ee:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed766b757fbef9bf965df3eb98123ebfa17eee87/; sid:903201857; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"db:41:09:56:af:c9:7c:c5:3d:e0:70:27:8c:24:43:93:80:b4:59:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db410956afc97cc53de070278c24439380b4596f/; sid:903201858; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"de:d2:72:f3:06:f9:a8:14:7d:00:b7:b5:d3:75:44:f6:3f:70:bb:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ded272f306f9a8147d00b7b5d37544f63f70bb35/; sid:903201859; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"fa:58:74:13:07:70:57:99:bc:d1:e9:3b:09:85:80:ac:fe:91:44:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa58741307705799bcd1e93b098580acfe9144dc/; sid:903201860; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"31:71:0a:be:62:15:f9:93:8e:43:eb:9a:43:52:29:9d:f0:06:a5:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31710abe6215f9938e43eb9a4352299df006a59d/; sid:903201861; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"df:af:2a:46:c7:26:8b:57:5c:b1:72:84:e1:28:aa:02:79:52:76:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfaf2a46c7268b575cb17284e128aa02795276e5/; sid:903201862; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"34:65:fc:30:7c:14:39:a0:1c:f6:56:2b:7d:0f:4c:25:ae:e4:9e:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3465fc307c1439a01cf6562b7d0f4c25aee49eb5/; sid:903201863; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"00:b0:19:58:89:06:8d:b8:4f:76:33:92:dc:18:06:f9:20:ad:03:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00b0195889068db84f763392dc1806f920ad030e/; sid:903201864; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"9c:ab:35:a0:e7:19:70:6d:ad:7f:7f:c2:85:c9:31:f1:79:8c:21:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9cab35a0e719706dad7f7fc285c931f1798c212d/; sid:903201865; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"cf:bb:86:65:d5:2d:17:bf:98:17:67:10:7e:43:90:5e:bd:e5:d7:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfbb8665d52d17bf981767107e43905ebde5d785/; sid:903201866; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"28:16:27:8e:8b:be:cf:9d:a5:d2:f4:87:7b:67:49:d4:3b:19:6c:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2816278e8bbecf9da5d2f4877b6749d43b196c95/; sid:903201867; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"87:1b:fc:42:26:10:b9:48:61:c1:7b:01:ba:14:b1:1e:67:20:ae:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/871bfc422610b94861c17b01ba14b11e6720aed9/; sid:903201868; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ca:7e:77:93:8c:b8:ca:7c:09:fa:52:41:37:d5:04:2d:6f:83:e2:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca7e77938cb8ca7c09fa524137d5042d6f83e21a/; sid:903201869; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"07:61:63:e0:fd:77:49:3e:b9:bd:25:22:60:c6:29:b5:35:80:68:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/076163e0fd77493eb9bd252260c629b5358068ec/; sid:903201870; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Nexuslogger C&C)"; tls_cert_fingerprint; content:"25:95:00:49:3b:3d:96:26:86:64:4a:9a:05:29:b1:c1:a0:60:cb:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/259500493b3d962686644a9a0529b1c1a060cbcc/; sid:903201871; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"56:2e:7f:2f:7b:3d:59:13:a6:ca:64:f2:58:54:d1:31:e5:6c:4f:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/562e7f2f7b3d5913a6ca64f25854d131e56c4ff7/; sid:903201872; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"72:a5:63:44:4b:6c:f3:3f:b6:e0:22:a0:1b:87:66:56:e1:ed:ee:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72a563444b6cf33fb6e022a01b876656e1edee40/; sid:903201873; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"00:45:eb:6e:50:c1:cc:da:72:f9:4b:56:2e:e1:7b:e7:5c:c2:06:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0045eb6e50c1ccda72f94b562ee17be75cc20673/; sid:903201874; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"42:90:40:19:16:56:3b:1a:e8:f3:9f:08:ee:ae:09:1b:ea:58:e2:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4290401916563b1ae8f39f08eeae091bea58e22b/; sid:903201875; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"1c:47:e7:5c:24:31:e7:2d:54:44:f1:1f:c9:37:84:e7:57:e1:5e:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c47e75c2431e72d5444f11fc93784e757e15e96/; sid:903201876; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"e2:70:46:6a:42:c2:e8:8a:72:c4:ba:41:3b:57:56:8e:f3:b8:eb:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e270466a42c2e88a72c4ba413b57568ef3b8eb92/; sid:903201877; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"51:f8:1c:38:66:68:5c:c2:fd:3d:82:c4:6d:7e:9d:0a:80:59:f0:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/51f81c3866685cc2fd3d82c46d7e9d0a8059f06e/; sid:903201878; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ca:31:e1:cf:30:44:1b:a1:22:73:44:51:f7:44:c9:67:15:1e:52:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca31e1cf30441ba122734451f744c967151e523b/; sid:903201879; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a2:e2:d3:0e:55:e3:44:30:68:e6:eb:cf:80:70:71:76:68:64:53:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a2e2d30e55e3443068e6ebcf807071766864530c/; sid:903201880; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d6:40:42:0a:23:80:27:0f:2b:84:5f:e2:4a:a5:a7:cf:f6:e2:35:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d640420a2380270f2b845fe24aa5a7cff6e235ad/; sid:903201881; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"12:ef:34:a0:47:2d:1d:50:22:8b:dc:bd:10:89:c7:28:f6:80:0d:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12ef34a0472d1d50228bdcbd1089c728f6800d9e/; sid:903201882; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"01:ad:b6:51:7f:e8:bf:0a:e1:6f:15:f8:1a:f2:43:7d:ed:2c:e3:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01adb6517fe8bf0ae16f15f81af2437ded2ce344/; sid:903201883; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f0:af:95:05:c7:af:2b:bf:df:1d:12:ae:fb:b7:a7:93:22:05:71:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0af9505c7af2bbfdf1d12aefbb7a7932205715f/; sid:903201884; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6f:df:54:29:fa:84:c5:58:5d:ed:4f:d9:a1:7f:d3:7e:95:71:1b:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fdf5429fa84c5585ded4fd9a17fd37e95711b4b/; sid:903201885; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"25:d0:ed:69:8d:99:4e:a8:d9:b9:11:0e:30:0c:1e:1f:92:59:be:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25d0ed698d994ea8d9b9110e300c1e1f9259be12/; sid:903201886; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"bc:6a:c5:d0:0e:99:18:d6:df:8a:74:e8:04:26:e0:fc:c6:73:28:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc6ac5d00e9918d6df8a74e80426e0fcc67328c6/; sid:903201887; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"cc:2a:6d:c9:ac:f4:3d:86:a2:1e:8b:f4:1f:f8:95:27:8b:e3:ae:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cc2a6dc9acf43d86a21e8bf41ff895278be3aedc/; sid:903201888; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"78:35:91:ef:d6:23:cf:4d:c9:83:8d:30:8b:f5:31:79:12:75:6e:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/783591efd623cf4dc9838d308bf5317912756e72/; sid:903201889; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0c:1f:dd:7c:00:86:b6:35:0a:39:68:51:62:62:a1:a9:59:a2:ec:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c1fdd7c0086b6350a3968516262a1a959a2ec54/; sid:903201890; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0f:6f:1a:ba:7e:fd:8c:2a:4a:aa:42:97:af:4c:06:1f:d1:c0:d5:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f6f1aba7efd8c2a4aaa4297af4c061fd1c0d5fd/; sid:903201891; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"17:e9:58:d3:00:3b:c9:07:32:46:bd:49:86:6c:35:58:70:a6:08:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17e958d3003bc9073246bd49866c355870a60830/; sid:903201892; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"86:71:4f:5c:1b:87:67:8d:50:20:f8:de:86:9c:d9:16:d2:89:e3:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86714f5c1b87678d5020f8de869cd916d289e342/; sid:903201893; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"95:c5:f2:03:35:4b:2d:79:fc:26:ff:27:ad:4b:e3:0a:8d:77:e3:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95c5f203354b2d79fc26ff27ad4be30a8d77e3b0/; sid:903201894; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b8:8e:f6:bc:d4:65:35:e4:58:18:90:c6:54:4c:ed:2a:54:e8:c9:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b88ef6bcd46535e4581890c6544ced2a54e8c954/; sid:903201895; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"92:aa:18:f0:49:98:20:1d:53:cc:a6:a4:b1:ee:19:06:8e:95:6b:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92aa18f04998201d53cca6a4b1ee19068e956ba2/; sid:903201896; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"66:05:0b:13:89:f3:e0:22:99:40:a5:c4:9a:51:0f:83:5a:63:6c:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66050b1389f3e0229940a5c49a510f835a636cf0/; sid:903201897; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"96:71:57:9d:3f:10:5a:86:85:de:1a:e4:93:42:66:a6:95:b7:62:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9671579d3f105a8685de1ae4934266a695b7628f/; sid:903201898; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b1:bc:81:f0:ac:31:58:27:e3:a2:60:d1:8b:d1:51:f4:48:da:f7:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b1bc81f0ac315827e3a260d18bd151f448daf710/; sid:903201899; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"be:f3:d6:8f:b9:62:f1:b6:68:e5:3a:d7:fa:c6:28:2e:2e:b0:60:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bef3d68fb962f1b668e53ad7fac6282e2eb0601c/; sid:903201900; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d3:fe:24:a0:f7:6a:0d:21:e7:a3:e4:19:28:ca:b7:be:18:57:5e:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3fe24a0f76a0d21e7a3e41928cab7be18575e53/; sid:903201901; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"09:9f:ad:79:46:60:b5:cc:f6:bf:89:78:2e:0c:b5:43:34:25:47:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/099fad794660b5ccf6bf89782e0cb543342547f1/; sid:903201902; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"45:34:bd:e6:bc:86:c0:a8:68:ec:74:56:6c:4c:be:16:e7:58:16:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4534bde6bc86c0a868ec74566c4cbe16e7581670/; sid:903201903; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6d:9a:2a:0e:9a:93:e2:8f:61:6d:f8:a5:8e:8c:6f:28:04:ce:89:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d9a2a0e9a93e28f616df8a58e8c6f2804ce8917/; sid:903201904; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"02:49:b9:53:aa:54:4b:b6:66:21:39:3f:23:c6:bc:33:b1:8c:fc:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0249b953aa544bb66621393f23c6bc33b18cfc1a/; sid:903201905; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f4:b1:7c:b0:f1:6e:e8:7d:af:9d:0f:f5:d8:1f:c7:b8:f0:ec:6c:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4b17cb0f16ee87daf9d0ff5d81fc7b8f0ec6cc2/; sid:903201906; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f6:53:9a:f4:03:9b:ea:25:bf:d1:b3:f6:78:47:fe:c8:e8:5a:3e:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f6539af4039bea25bfd1b3f67847fec8e85a3e29/; sid:903201907; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:b0:4b:6f:8a:49:40:39:5b:36:70:ed:69:56:bf:3d:35:b5:8a:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e2b04b6f8a4940395b3670ed6956bf3d35b58a11/; sid:903201908; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a1:49:71:d2:d9:bc:0c:b5:4e:11:4d:3c:34:e6:fe:34:88:73:61:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a14971d2d9bc0cb54e114d3c34e6fe348873613a/; sid:903201909; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4f:49:88:b7:db:26:30:64:1b:56:27:90:b0:fb:c9:69:3f:4c:f7:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4f4988b7db2630641b562790b0fbc9693f4cf7ae/; sid:903201910; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"62:30:08:22:fe:df:08:22:23:71:5f:41:02:ea:40:ff:90:11:d5:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62300822fedf082223715f4102ea40ff9011d52a/; sid:903201911; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6b:1e:e9:ad:97:72:9a:d1:38:58:fa:ae:63:78:ae:63:55:4d:a7:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b1ee9ad97729ad13858faae6378ae63554da7ff/; sid:903201912; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"57:b7:84:9a:53:f7:2b:06:da:11:bf:ac:40:87:9b:07:83:aa:4f:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/57b7849a53f72b06da11bfac40879b0783aa4ff5/; sid:903201913; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ed:f8:ab:0a:1c:4c:29:de:e0:95:81:fc:87:85:38:72:78:22:73:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/edf8ab0a1c4c29dee09581fc8785387278227377/; sid:903201914; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"11:c0:28:08:a8:5d:24:5a:e7:9c:15:0f:57:e6:aa:8b:cf:43:a3:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11c02808a85d245ae79c150f57e6aa8bcf43a328/; sid:903201915; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"03:5d:18:7b:fe:97:58:1d:22:9f:eb:da:2a:8a:1c:b2:92:ed:64:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/035d187bfe97581d229febda2a8a1cb292ed64da/; sid:903201916; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"af:49:0a:39:38:ed:f5:30:c7:70:aa:a9:46:8c:6c:59:a1:b5:0c:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af490a3938edf530c770aaa9468c6c59a1b50cc1/; sid:903201917; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"84:94:f0:c0:94:c2:4a:1f:d2:c1:12:26:89:60:19:b0:97:fe:bc:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8494f0c094c24a1fd2c11226896019b097febccf/; sid:903201918; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"12:dd:4c:2c:c3:23:7e:d0:04:09:82:77:b0:0d:43:32:c7:cc:07:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12dd4c2cc3237ed004098277b00d4332c7cc07f3/; sid:903201919; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"14:4b:04:7f:c5:2f:3d:2e:66:28:33:8e:54:82:cd:e2:9a:1c:eb:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/144b047fc52f3d2e6628338e5482cde29a1ceb3d/; sid:903201920; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"48:fd:38:08:98:71:b8:7f:2e:6b:1c:4a:57:93:ce:67:ec:5e:81:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/48fd38089871b87f2e6b1c4a5793ce67ec5e818e/; sid:903201921; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1c:68:db:74:33:35:41:7a:e9:84:65:5b:32:6d:8b:a3:bb:1e:7b:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1c68db743335417ae984655b326d8ba3bb1e7b16/; sid:903201922; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6e:ae:fc:28:4c:6c:bd:c8:0d:92:a0:30:5b:ea:ec:a7:26:dd:93:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6eaefc284c6cbdc80d92a0305beaeca726dd9377/; sid:903201923; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"17:87:4b:a0:64:a5:a5:a8:4d:90:93:e3:21:cd:0a:cb:da:2f:af:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17874ba064a5a5a84d9093e321cd0acbda2faf7c/; sid:903201924; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4a:07:04:97:08:1d:fa:f8:9f:32:4f:48:96:a9:1e:db:9c:42:5c:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a070497081dfaf89f324f4896a91edb9c425c0c/; sid:903201925; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b4:a8:b5:5e:d5:00:a0:8f:3c:83:c2:f4:70:8a:ea:66:a5:d5:21:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4a8b55ed500a08f3c83c2f4708aea66a5d521dc/; sid:903201926; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:77:0c:be:6b:23:2f:7e:28:1c:48:05:a5:76:00:fe:d3:c9:ea:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1770cbe6b232f7e281c4805a57600fed3c9ea02/; sid:903201927; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:98:bd:ab:a9:51:57:b5:c5:76:6f:20:ac:2d:c0:d9:6b:91:4a:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4598bdaba95157b5c5766f20ac2dc0d96b914a56/; sid:903201928; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4f:a9:9c:8b:c1:7b:90:c2:e3:61:20:c3:4f:12:ed:a4:74:77:d7:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4fa99c8bc17b90c2e36120c34f12eda47477d7ff/; sid:903201929; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"07:60:b7:06:96:97:6b:36:ee:cc:0a:67:1b:7f:f7:10:b8:19:fe:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0760b70696976b36eecc0a671b7ff710b819fea7/; sid:903201930; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"00:9f:d7:0b:9f:42:a2:b3:70:c8:5a:60:a7:7b:2f:cd:7a:7c:0b:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/009fd70b9f42a2b370c85a60a77b2fcd7a7c0ba7/; sid:903201931; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"db:59:b9:5d:87:49:a7:79:b9:0e:e7:d3:b9:3c:d7:b4:b1:66:6b:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db59b95d8749a779b90ee7d3b93cd7b4b1666bfe/; sid:903201932; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ba:7c:40:be:7d:c0:68:2a:66:8d:16:31:58:5e:f2:88:a6:24:7d:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba7c40be7dc0682a668d1631585ef288a6247d4e/; sid:903201933; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a6:cb:f1:d8:6d:bc:3c:09:48:3c:fd:3d:28:34:00:8b:05:a0:3f:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6cbf1d86dbc3c09483cfd3d2834008b05a03fd9/; sid:903201934; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"50:ea:19:98:63:00:e1:f3:13:d7:81:12:8f:6f:dd:8b:8f:ef:57:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50ea19986300e1f313d781128f6fdd8b8fef57c8/; sid:903201935; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ad:72:3f:df:00:4b:0c:35:f3:cc:37:a8:b0:5b:ee:79:c1:24:ab:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ad723fdf004b0c35f3cc37a8b05bee79c124ab54/; sid:903201936; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a3:02:02:f4:2c:88:49:7e:50:8e:87:f6:9d:18:da:e1:56:c6:9b:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a30202f42c88497e508e87f69d18dae156c69b27/; sid:903201937; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"95:37:5f:69:c1:da:e0:bd:3b:35:a1:91:ac:67:d1:c5:8f:f3:9a:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95375f69c1dae0bd3b35a191ac67d1c58ff39ac6/; sid:903201938; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"17:e4:cc:52:40:26:2f:73:f6:c1:ae:27:21:72:4e:d0:f5:47:a5:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17e4cc5240262f73f6c1ae2721724ed0f547a59c/; sid:903201939; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"62:c3:0b:50:ec:e6:ce:29:03:1d:5b:1f:38:66:b1:5f:bd:65:6a:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/62c30b50ece6ce29031d5b1f3866b15fbd656a6b/; sid:903201940; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"22:da:4d:7c:a0:81:b1:10:b6:c2:a1:83:a3:20:59:67:33:7e:9e:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22da4d7ca081b110b6c2a183a3205967337e9e86/; sid:903201941; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"19:a4:d2:66:64:45:94:c1:a7:d5:f2:5e:79:49:02:fb:05:29:27:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19a4d266644594c1a7d5f25e794902fb05292723/; sid:903201942; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b5:37:02:cc:09:cf:8a:18:62:18:33:37:95:7f:87:15:c3:8c:b7:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b53702cc09cf8a1862183337957f8715c38cb733/; sid:903201943; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ce:83:65:cf:f9:9b:43:09:66:6a:66:1a:f5:95:50:be:8c:a0:7f:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce8365cff99b4309666a661af59550be8ca07f8a/; sid:903201944; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"1b:82:37:30:66:3d:26:e7:23:ff:e3:08:c1:9e:7c:68:70:2a:57:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b823730663d26e723ffe308c19e7c68702a5724/; sid:903201945; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"37:f2:11:b8:02:4c:72:06:e4:01:50:dc:a9:38:f5:c8:38:a6:29:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37f211b8024c7206e40150dca938f5c838a629a3/; sid:903201946; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0c:84:12:99:8e:79:a3:3f:88:1f:85:cc:a8:3c:6b:37:51:1f:cc:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c8412998e79a33f881f85cca83c6b37511fcc23/; sid:903201947; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"be:eb:2a:73:ea:8a:82:94:57:e8:8e:ce:92:e5:6a:b6:ba:e2:51:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/beeb2a73ea8a829457e88ece92e56ab6bae25199/; sid:903201948; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"f4:05:f9:49:fd:09:35:ca:b1:66:08:44:97:43:3f:66:e0:a1:93:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f405f949fd0935cab166084497433f66e0a19318/; sid:903201949; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"ca:a4:74:67:05:d7:82:3a:39:b0:ff:a7:07:ee:6d:ec:2a:f4:d3:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/caa4746705d7823a39b0ffa707ee6dec2af4d3d5/; sid:903201950; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c1:ec:4f:82:e7:f1:98:c4:fd:d4:00:9d:68:06:64:4d:01:f2:f8:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1ec4f82e7f198c4fdd4009d6806644d01f2f810/; sid:903201951; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d7:a1:9b:9e:da:fb:2f:bb:7d:40:4f:c7:9c:0c:cd:ef:5a:12:79:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7a19b9edafb2fbb7d404fc79c0ccdef5a1279c1/; sid:903201952; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"60:a3:27:75:01:a9:2e:68:e7:b7:03:31:98:5a:38:36:67:9e:72:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60a3277501a92e68e7b70331985a3836679e72df/; sid:903201953; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"b9:ae:e8:cc:c7:a3:f5:28:09:91:db:ef:66:28:bb:b1:af:9e:85:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b9aee8ccc7a3f5280991dbef6628bbb1af9e857a/; sid:903201954; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"55:83:32:67:b8:62:bb:54:33:10:a6:56:10:48:4c:a0:ab:62:e6:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55833267b862bb543310a65610484ca0ab62e666/; sid:903201955; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"54:b0:ac:0b:bc:4d:2e:7e:af:81:fc:8e:a2:ef:c2:2d:86:ce:c6:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54b0ac0bbc4d2e7eaf81fc8ea2efc22d86cec64f/; sid:903201956; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"f3:89:a4:bc:ed:c2:3e:de:90:05:61:91:54:8f:5f:ac:03:bd:2b:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f389a4bcedc23ede90056191548f5fac03bd2b18/; sid:903201957; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"27:97:59:7a:7b:c6:b3:b4:5f:9e:5e:c6:de:47:10:53:71:26:fc:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2797597a7bc6b3b45f9e5ec6de4710537126fc03/; sid:903201958; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"bd:2a:7a:d9:37:83:9a:60:8c:56:60:6b:ef:85:e4:3a:cd:09:4e:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bd2a7ad937839a608c56606bef85e43acd094e4e/; sid:903201959; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"65:f1:c7:95:61:9f:25:89:cc:4f:22:8a:59:0d:01:e4:8d:db:2e:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/65f1c795619f2589cc4f228a590d01e48ddb2e88/; sid:903201960; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"25:c4:0c:a8:3f:45:f3:2a:bf:ad:18:ca:50:a7:ac:14:d4:b0:2a:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25c40ca83f45f32abfad18ca50a7ac14d4b02af8/; sid:903201961; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"bf:7a:de:50:fd:ef:af:43:e6:99:4f:8b:45:65:ab:19:92:da:08:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf7ade50fdefaf43e6994f8b4565ab1992da086d/; sid:903201962; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"7e:8e:41:1b:64:6d:5e:d8:37:3d:5c:86:7f:23:a4:a4:05:aa:72:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e8e411b646d5ed8373d5c867f23a4a405aa7238/; sid:903201963; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"44:68:ce:d9:56:de:cf:14:39:e9:e4:53:13:62:d1:a3:94:fa:e8:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4468ced956decf1439e9e4531362d1a394fae8fb/; sid:903201964; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"f2:66:29:99:5e:1c:de:46:3b:8e:3d:b3:de:0c:d8:1b:33:4d:03:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f26629995e1cde463b8e3db3de0cd81b334d03e4/; sid:903201965; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"a5:d3:8f:17:fb:fb:1a:e0:b9:29:bd:1d:7d:3b:d9:ae:2d:16:6c:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5d38f17fbfb1ae0b929bd1d7d3bd9ae2d166c28/; sid:903201966; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"20:09:d3:92:b9:dc:fa:e2:cc:cd:84:2c:9f:da:d5:6b:64:73:7b:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2009d392b9dcfae2cccd842c9fdad56b64737b80/; sid:903201967; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"c9:74:f1:b0:2b:43:17:63:7a:ad:55:c6:ce:33:e1:b8:de:25:20:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c974f1b02b4317637aad55c6ce33e1b8de2520c5/; sid:903201968; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"97:de:75:8a:7c:3c:86:1c:32:f1:59:f3:9d:08:ab:d0:49:9d:93:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97de758a7c3c861c32f159f39d08abd0499d9383/; sid:903201969; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"46:37:13:30:70:06:11:77:3c:8f:df:04:d6:0a:84:b0:0b:0a:a5:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46371330700611773c8fdf04d60a84b00b0aa5fb/; sid:903201970; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d4:ad:3a:76:55:2e:f6:2f:ac:1b:cb:c0:ae:e1:c6:f1:f0:85:13:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4ad3a76552ef62fac1bcbc0aee1c6f1f085137a/; sid:903201971; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5e:21:63:42:42:a7:53:44:d3:ac:3e:a4:bf:0a:c6:6e:ae:04:f6:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e21634242a75344d3ac3ea4bf0ac66eae04f627/; sid:903201972; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"57:b7:a7:71:46:f4:0c:f0:14:6f:b7:5f:ab:34:8e:e2:8d:d3:c3:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/57b7a77146f40cf0146fb75fab348ee28dd3c3be/; sid:903201973; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"3c:b3:8f:ea:d3:63:d5:48:0a:2a:23:d2:6b:26:9e:d4:34:fa:07:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cb38fead363d5480a2a23d26b269ed434fa078f/; sid:903201974; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"33:27:ed:64:60:b6:71:41:b8:ce:5e:ea:30:7d:d8:6d:8b:ab:62:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3327ed6460b67141b8ce5eea307dd86d8bab626c/; sid:903201975; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"76:be:20:15:18:6a:03:af:bf:39:80:6c:e7:19:84:2f:93:39:e2:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/76be2015186a03afbf39806ce719842f9339e2ea/; sid:903201976; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"61:3c:96:82:e9:87:17:7b:ee:34:a4:40:0d:5b:08:b7:8b:42:a5:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/613c9682e987177bee34a4400d5b08b78b42a5b5/; sid:903201977; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3d:f4:48:e1:4c:99:f7:a2:5d:86:72:4d:d8:3d:be:6c:d1:36:b4:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3df448e14c99f7a25d86724dd83dbe6cd136b42e/; sid:903201978; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"74:39:d5:01:75:77:95:b6:f9:0f:56:af:10:c9:bc:5d:c7:db:94:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7439d501757795b6f90f56af10c9bc5dc7db94c0/; sid:903201979; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:00:f2:9c:44:34:c0:ef:3e:70:cf:7d:63:ea:ef:69:bf:75:7f:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4500f29c4434c0ef3e70cf7d63eaef69bf757fb2/; sid:903201980; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2b:b3:62:e2:91:3b:9e:2c:0e:db:cb:db:dd:aa:f2:33:12:33:a9:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2bb362e2913b9e2c0edbcbdbddaaf2331233a991/; sid:903201981; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"87:ca:c3:d8:c1:6c:e0:72:8e:86:bf:9e:69:59:6f:fd:ca:f9:db:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87cac3d8c16ce0728e86bf9e69596ffdcaf9db8f/; sid:903201982; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"76:1a:a0:2e:86:54:2b:d5:dd:13:ab:b8:3b:59:5a:f2:36:a7:38:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/761aa02e86542bd5dd13abb83b595af236a738a9/; sid:903201983; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"53:3a:4d:57:8c:89:48:a5:38:25:ca:52:e3:70:5f:2f:26:9b:58:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/533a4d578c8948a53825ca52e3705f2f269b588a/; sid:903201984; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"91:1a:66:48:e7:3b:89:1a:58:89:04:e1:fa:f8:c8:90:1d:e9:f0:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/911a6648e73b891a588904e1faf8c8901de9f08d/; sid:903201985; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"83:0f:59:68:57:11:41:04:95:b9:76:fb:c6:ae:a3:88:bd:7b:82:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/830f59685711410495b976fbc6aea388bd7b8213/; sid:903201986; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1b:66:5c:e2:1b:59:2d:d2:bc:c9:95:18:88:db:c0:f1:9f:5b:ed:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b665ce21b592dd2bcc9951888dbc0f19f5bede3/; sid:903201987; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ac:1d:f3:9c:13:e4:78:3f:37:de:77:4c:0b:df:8b:f1:ed:9a:3f:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac1df39c13e4783f37de774c0bdf8bf1ed9a3f8e/; sid:903201988; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"19:db:b5:56:06:74:86:a7:89:84:78:51:a7:93:ef:ba:00:d4:c4:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19dbb556067486a789847851a793efba00d4c4b8/; sid:903201989; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"d9:85:3b:64:22:06:cd:48:97:d6:9f:78:c6:4b:27:42:43:82:3e:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d9853b642206cd4897d69f78c64b274243823e83/; sid:903201990; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e6:c3:6a:e1:c5:84:a3:a5:f0:e0:ac:ae:9c:c8:8f:fd:e9:db:c9:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e6c36ae1c584a3a5f0e0acae9cc88ffde9dbc9aa/; sid:903201991; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"8a:da:65:cf:9b:dd:81:60:41:5b:02:8d:c4:fb:15:28:8b:8e:56:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ada65cf9bdd8160415b028dc4fb15288b8e5677/; sid:903201992; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c1:9c:48:ca:9b:bd:9d:98:c3:1d:30:f8:31:9e:a2:b8:f4:95:fa:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c19c48ca9bbd9d98c31d30f8319ea2b8f495fada/; sid:903201993; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"6f:e5:15:9d:cd:44:21:48:ba:16:26:97:0d:46:39:5f:60:a3:38:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fe5159dcd442148ba1626970d46395f60a3381c/; sid:903201994; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"77:c1:91:2e:2a:4f:80:68:49:03:44:16:fb:aa:bb:af:c1:46:22:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77c1912e2a4f806849034416fbaabbafc14622df/; sid:903201995; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ef:ed:79:af:32:bf:cb:56:2d:93:95:63:a5:df:85:ed:fe:41:8b:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/efed79af32bfcb562d939563a5df85edfe418b5c/; sid:903201996; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"7f:51:72:b4:ca:fe:33:05:60:d8:85:2c:11:6c:01:04:05:d9:bb:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f5172b4cafe330560d8852c116c010405d9bb82/; sid:903201997; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"60:ed:f4:25:3a:2b:81:cc:f0:d6:9c:ac:6f:e1:ec:b1:bc:3b:66:7d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60edf4253a2b81ccf0d69cac6fe1ecb1bc3b667d/; sid:903201998; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1b:1d:f7:07:8d:71:80:53:31:20:37:cc:fe:1f:86:7d:cc:59:3e:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b1df7078d718053312037ccfe1f867dcc593ec5/; sid:903201999; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a5:d7:00:a9:8f:78:95:42:01:84:34:86:f3:34:fd:75:71:8f:91:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5d700a98f78954201843486f334fd75718f91ed/; sid:903202000; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4a:26:8f:ea:4c:de:0b:bc:cb:a9:42:90:02:a1:e4:fc:63:8e:58:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a268fea4cde0bbccba9429002a1e4fc638e58b8/; sid:903202001; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"70:50:66:39:1f:2b:7f:8c:c3:50:46:7b:b3:37:64:8c:c1:76:82:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/705066391f2b7f8cc350467bb337648cc1768256/; sid:903202002; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AKBuilder C&C)"; tls_cert_fingerprint; content:"6e:ce:5e:ce:41:92:68:3d:2d:84:e2:5b:0b:a7:e0:4f:9c:b7:eb:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c/; sid:903202003; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"75:20:f2:3b:99:d6:fe:a6:3f:0c:1b:ae:e0:c8:3d:b0:35:a1:dd:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7520f23b99d6fea63f0c1baee0c83db035a1ddd1/; sid:903202004; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"58:70:6c:c0:c8:da:4d:ae:3b:6b:a6:80:88:20:be:33:3e:41:86:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/58706cc0c8da4dae3b6ba6808820be333e41862e/; sid:903202005; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a3:a8:da:e5:3a:7f:e1:56:ef:e5:05:25:3f:4c:c8:f0:0f:d2:27:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a3a8dae53a7fe156efe505253f4cc8f00fd22732/; sid:903202006; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9d:2a:25:5f:77:02:90:2d:f8:f1:df:9a:89:e4:b5:5c:ae:5b:da:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d2a255f7702902df8f1df9a89e4b55cae5bda58/; sid:903202007; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"68:e3:7d:a0:89:22:44:80:41:11:9e:43:2c:2a:30:57:99:2c:58:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68e37da08922448041119e432c2a3057992c586e/; sid:903202008; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c8:54:ce:95:58:79:ab:d2:78:69:5a:a3:72:3a:a5:b8:b3:6f:0e:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c854ce955879abd278695aa3723aa5b8b36f0e59/; sid:903202009; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"0a:14:dd:97:f0:1d:b2:e1:c2:f7:c7:51:08:be:46:df:32:11:df:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0a14dd97f01db2e1c2f7c75108be46df3211df45/; sid:903202010; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"97:ef:89:ff:cd:19:d6:bf:00:03:2f:20:bf:a2:d3:c2:a1:40:7d:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97ef89ffcd19d6bf00032f20bfa2d3c2a1407ddb/; sid:903202011; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Chthonic C&C)"; tls_cert_fingerprint; content:"d0:68:91:73:fe:15:4f:ce:3a:6b:ff:92:64:83:9c:f6:c5:b9:17:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0689173fe154fce3a6bff9264839cf6c5b91742/; sid:903202012; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ce:52:98:b9:c6:a5:d2:19:7c:0c:24:af:2f:f9:fd:0e:71:17:90:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce5298b9c6a5d2197c0c24af2ff9fd0e711790de/; sid:903202013; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5c:49:8b:ef:f2:d6:50:7d:0d:05:1a:15:f0:8b:55:16:60:24:76:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c498beff2d6507d0d051a15f08b5516602476ae/; sid:903202014; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"73:74:b2:80:9b:ba:52:95:4d:c6:1b:4b:cf:e7:00:52:41:e2:c6:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7374b2809bba52954dc61b4bcfe7005241e2c653/; sid:903202015; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2b:0a:76:17:8c:be:81:a7:c1:76:27:fd:36:15:da:09:0c:74:78:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b0a76178cbe81a7c17627fd3615da090c747892/; sid:903202016; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"52:16:0f:04:33:ec:ad:d7:86:69:56:7f:b0:ea:3e:6d:be:58:62:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52160f0433ecadd78669567fb0ea3e6dbe586261/; sid:903202017; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TorrentLocker C&C)"; tls_cert_fingerprint; content:"12:b4:b8:c8:1b:a4:77:31:a8:1f:dc:ad:11:1a:0f:38:ad:5b:09:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12b4b8c81ba47731a81fdcad111a0f38ad5b09e6/; sid:903202018; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Neutrino C&C)"; tls_cert_fingerprint; content:"17:f0:1f:88:9f:10:bc:21:b6:6f:d8:76:9b:c4:16:34:51:49:4b:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17f01f889f10bc21b66fd8769bc4163451494b4b/; sid:903202019; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"cf:31:d2:f8:e4:19:d7:65:17:b0:bc:6c:3e:ad:1f:24:6b:95:0a:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf31d2f8e419d76517b0bc6c3ead1f246b950a42/; sid:903202020; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"da:5e:5d:bf:5a:86:3b:6d:29:23:eb:fd:ce:4a:28:0d:8b:df:03:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da5e5dbf5a863b6d2923ebfdce4a280d8bdf0374/; sid:903202021; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cf:38:65:6e:14:9d:da:84:cf:cb:94:f3:b3:50:34:e4:18:ba:7f:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf38656e149dda84cfcb94f3b35034e418ba7fe6/; sid:903202022; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f2:d6:16:c7:a3:cc:bb:99:38:6e:f6:1e:4d:43:56:8c:8b:9b:7f:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f2d616c7a3ccbb99386ef61e4d43568c8b9b7f2b/; sid:903202023; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (DiamondFox C&C)"; tls_cert_fingerprint; content:"ea:17:68:5c:b3:c6:b4:d2:25:a0:d1:ce:21:3a:2f:6c:2c:fd:e8:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ea17685cb3c6b4d225a0d1ce213a2f6c2cfde824/; sid:903202024; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"dc:39:c2:60:7c:2c:b0:ad:74:65:fd:6b:8f:99:d2:37:a4:a0:8a:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc39c2607c2cb0ad7465fd6b8f99d237a4a08a71/; sid:903202025; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"47:51:d4:a2:bb:7e:4c:ae:6d:51:f7:43:c7:3c:2d:5f:92:53:0b:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4751d4a2bb7e4cae6d51f743c73c2d5f92530be5/; sid:903202026; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"91:69:29:ef:b6:27:85:6e:86:6d:f6:32:1b:7e:9a:a8:16:7a:53:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/916929efb627856e866df6321b7e9aa8167a53ad/; sid:903202027; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"b4:9c:d7:3e:2b:de:b2:d1:2f:e8:b0:8f:d5:e1:8d:77:fe:89:c3:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b49cd73e2bdeb2d12fe8b08fd5e18d77fe89c37e/; sid:903202028; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"ed:c8:9e:34:63:30:02:83:05:25:53:7c:cc:2f:cf:65:ab:2f:43:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/edc89e34633002830525537ccc2fcf65ab2f43dd/; sid:903202029; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"31:bf:c8:fe:a6:c3:99:e6:9e:7e:ce:77:19:99:af:1e:23:f7:44:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31bfc8fea6c399e69e7ece771999af1e23f74445/; sid:903202030; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Nexuslogger C&C)"; tls_cert_fingerprint; content:"a6:51:18:56:07:80:ca:37:f8:68:75:b6:8b:d7:f2:80:15:2a:8f:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a65118560780ca37f86875b68bd7f280152a8f7c/; sid:903202031; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"6a:13:52:f9:9b:9a:48:d5:38:16:9c:ac:bf:57:ac:e3:27:16:84:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a1352f99b9a48d538169cacbf57ace327168499/; sid:903202032; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"3c:f3:94:36:9b:c8:24:5b:1e:eb:00:e6:b5:ee:74:52:8d:0f:e0:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cf394369bc8245b1eeb00e6b5ee74528d0fe01f/; sid:903202033; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"67:d4:57:d4:91:af:d8:0a:81:de:88:53:70:31:7b:0b:84:1d:68:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/67d457d491afd80a81de885370317b0b841d68c8/; sid:903202034; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"89:f0:1f:d3:65:51:67:34:2d:71:eb:de:e5:15:2a:11:84:9e:0c:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89f01fd3655167342d71ebdee5152a11849e0caa/; sid:903202035; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"9b:a1:f6:31:ca:af:b3:33:f3:c8:fa:f8:27:19:a7:26:42:95:59:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ba1f631caafb333f3c8faf82719a72642955927/; sid:903202036; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"16:ba:5b:21:4b:47:f1:53:61:21:d4:39:38:10:ad:4f:6e:7a:2b:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/16ba5b214b47f1536121d4393810ad4f6e7a2b7c/; sid:903202037; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"01:f6:b2:93:e6:61:6b:ad:21:c2:ec:f8:08:df:51:ea:b4:17:34:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01f6b293e6616bad21c2ecf808df51eab4173471/; sid:903202038; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Nexuslogger C&C)"; tls_cert_fingerprint; content:"e8:cc:06:a8:b1:90:72:66:0d:b7:22:29:be:2c:80:b4:83:36:85:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8cc06a8b19072660db72229be2c80b48336852e/; sid:903202039; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f9:b6:53:1c:4b:8f:43:a8:a6:85:66:db:27:ea:f9:b4:b1:42:87:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f9b6531c4b8f43a8a68566db27eaf9b4b142871b/; sid:903202040; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"22:aa:5a:ef:e5:69:e7:17:6e:e1:df:b1:66:db:45:fa:b4:cc:7b:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22aa5aefe569e7176ee1dfb166db45fab4cc7b35/; sid:903202041; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"17:10:fe:0b:2e:03:54:bb:0c:8a:96:c4:fe:bd:42:46:22:26:be:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1710fe0b2e0354bb0c8a96c4febd42462226be5a/; sid:903202042; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"32:b2:81:05:c1:e7:51:fb:41:6d:78:75:1c:f3:61:25:d6:43:34:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32b28105c1e751fb416d78751cf36125d6433422/; sid:903202043; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"92:55:dc:0f:98:91:31:1a:fe:8b:33:65:91:2b:83:65:3e:87:74:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9255dc0f9891311afe8b3365912b83653e877452/; sid:903202044; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"57:40:21:bf:d9:fb:dc:88:b6:3c:e9:13:83:63:0a:83:e8:46:4a:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/574021bfd9fbdc88b63ce91383630a83e8464a89/; sid:903202045; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d7:a8:e8:28:12:82:bb:30:fc:d8:b1:80:f9:a7:0b:01:7d:40:7d:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7a8e8281282bb30fcd8b180f9a70b017d407df5/; sid:903202046; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4a:54:5f:cd:b6:5b:43:3b:8b:0b:d6:18:6b:d9:b3:71:f1:4f:1a:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a545fcdb65b433b8b0bd6186bd9b371f14f1ad8/; sid:903202047; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b4:d5:45:68:21:8b:36:49:fe:0b:50:ea:e6:ca:0e:0b:41:0e:1a:81"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4d54568218b3649fe0b50eae6ca0e0b410e1a81/; sid:903202048; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"40:48:18:7e:49:4e:0a:98:64:0d:84:20:98:62:71:51:8e:24:2f:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4048187e494e0a98640d8420986271518e242ff8/; sid:903202049; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Smoke Loader C&C)"; tls_cert_fingerprint; content:"19:3a:05:c5:32:5d:1c:c0:cb:f4:8e:87:f6:1e:95:e7:21:58:8b:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/193a05c5325d1cc0cbf48e87f61e95e721588bcc/; sid:903202050; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"3a:e6:f6:0d:a1:6b:99:c5:80:7f:e9:3e:47:29:ad:7c:2f:4f:fa:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ae6f60da16b99c5807fe93e4729ad7c2f4ffab3/; sid:903202051; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ce:30:fa:24:a8:f2:e2:69:64:97:43:64:16:63:61:31:58:b6:3a:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce30fa24a8f2e269649743641663613158b63aa6/; sid:903202052; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"fc:d3:3d:87:46:b4:51:11:d0:e3:bd:b0:c4:0b:36:55:4d:91:06:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fcd33d8746b45111d0e3bdb0c40b36554d910603/; sid:903202053; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"34:f0:60:57:ee:a1:ba:0e:cd:07:34:fb:78:90:e5:b5:4b:3f:89:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34f06057eea1ba0ecd0734fb7890e5b54b3f89dc/; sid:903202054; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"fb:0c:d7:3b:25:89:ef:a2:bc:1c:7b:32:02:ae:c0:7b:36:77:62:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb0cd73b2589efa2bc1c7b3202aec07b36776207/; sid:903202055; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"22:f5:4e:90:fa:b6:d8:ee:7f:6d:09:38:49:46:73:77:51:90:0c:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22f54e90fab6d8ee7f6d09384946737751900c4d/; sid:903202056; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"e0:04:28:f7:1b:20:23:86:aa:c4:31:cc:90:06:8e:92:04:f3:d5:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e00428f71b202386aac431cc90068e9204f3d586/; sid:903202057; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"9c:29:b1:8c:09:1c:31:71:a8:72:74:b0:d9:5e:d7:98:24:61:79:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c29b18c091c3171a87274b0d95ed798246179c4/; sid:903202058; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"83:15:a2:dc:68:8a:96:cb:70:25:e0:69:32:9c:cd:5a:0a:6a:c4:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8315a2dc688a96cb7025e069329ccd5a0a6ac4d1/; sid:903202059; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"66:5d:62:ba:17:47:7c:9c:a3:93:bf:a8:08:f4:e5:58:50:9f:98:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/665d62ba17477c9ca393bfa808f4e558509f9876/; sid:903202060; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f3:e8:5e:c8:d7:b2:0e:45:b9:cc:64:91:be:f0:98:df:78:bb:17:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f3e85ec8d7b20e45b9cc6491bef098df78bb17cf/; sid:903202061; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ec:3f:c0:68:bc:44:18:a6:3e:24:06:bc:b8:67:4a:af:11:40:8b:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec3fc068bc4418a63e2406bcb8674aaf11408b50/; sid:903202062; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"14:e5:63:51:9a:67:e0:07:73:3e:e6:87:a2:37:c6:86:a2:a6:2c:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14e563519a67e007733ee687a237c686a2a62c2f/; sid:903202063; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b8:f9:10:c7:f8:ce:9a:7c:e3:91:8a:24:38:af:dd:be:01:3b:e8:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b8f910c7f8ce9a7ce3918a2438afddbe013be80e/; sid:903202064; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Zloader C&C)"; tls_cert_fingerprint; content:"d8:27:5a:0d:7a:e3:27:68:79:7e:c2:cc:f1:c0:fc:2f:f5:98:a1:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8275a0d7ae32768797ec2ccf1c0fc2ff598a1ae/; sid:903202065; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ca:7d:35:ea:0a:3e:63:56:40:07:f8:00:3e:e1:13:a2:d6:1d:b6:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca7d35ea0a3e63564007f8003ee113a2d61db61d/; sid:903202066; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"02:4c:bd:cb:0f:37:95:ef:6d:7e:f2:49:af:3b:34:73:da:6a:47:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/024cbdcb0f3795ef6d7ef249af3b3473da6a4790/; sid:903202067; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"26:e1:30:af:6c:10:9c:b7:ed:1d:41:11:11:9c:83:e8:35:7e:8f:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26e130af6c109cb7ed1d4111119c83e8357e8f9c/; sid:903202068; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"61:45:cb:40:6e:2f:cd:03:a2:e6:d1:13:ef:ae:6c:a2:c3:88:eb:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6145cb406e2fcd03a2e6d113efae6ca2c388eb8b/; sid:903202069; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"93:08:54:97:ea:75:11:d4:75:94:d0:04:14:2d:13:b6:9f:2e:48:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93085497ea7511d47594d004142d13b69f2e4847/; sid:903202070; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"0b:fd:e5:36:68:bf:3b:68:63:86:d9:48:77:bb:f7:f2:48:b3:53:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0bfde53668bf3b686386d94877bbf7f248b3530e/; sid:903202071; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"af:ce:eb:97:ab:ea:d6:b3:50:73:c4:1a:10:20:06:af:91:3e:66:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/afceeb97abead6b35073c41a102006af913e66b7/; sid:903202072; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f3:3d:f7:12:50:2b:b0:ce:4b:10:d8:d0:84:6a:26:7d:fc:6b:fc:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f33df712502bb0ce4b10d8d0846a267dfc6bfc68/; sid:903202073; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"24:2e:ed:6d:11:b9:c0:7e:c9:10:3b:63:75:85:95:b8:c2:1a:ff:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/242eed6d11b9c07ec9103b63758595b8c21affd3/; sid:903202074; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Smoke Loader C&C)"; tls_cert_fingerprint; content:"17:db:88:74:48:8b:8a:df:06:b3:00:50:75:06:c4:bd:e0:48:bf:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/17db8874488b8adf06b300507506c4bde048bfe2/; sid:903202075; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ca:a3:0a:d0:8b:fe:bf:e9:6b:b8:66:22:ac:a4:32:01:ba:53:9d:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/caa30ad08bfebfe96bb86622aca43201ba539de1/; sid:903202076; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6e:ef:f6:fc:73:ac:46:76:03:56:29:69:c3:f2:44:ed:dc:6a:95:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6eeff6fc73ac467603562969c3f244eddc6a9500/; sid:903202077; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"3e:0a:89:f4:59:60:32:4c:92:55:a3:9d:4a:96:12:be:5a:90:27:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e0a89f45960324c9255a39d4a9612be5a90270a/; sid:903202078; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"81:b0:b0:66:89:87:30:5b:07:73:5c:57:9d:de:92:e0:93:fe:96:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/81b0b0668987305b07735c579dde92e093fe9659/; sid:903202079; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1f:a2:ee:1c:77:52:37:8d:e3:66:1c:2d:aa:6c:17:54:74:9b:b3:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fa2ee1c7752378de3661c2daa6c1754749bb313/; sid:903202080; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"e2:f2:18:54:fa:46:f4:70:10:c1:e4:38:fc:89:33:56:64:4e:f1:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e2f21854fa46f47010c1e438fc893356644ef1e2/; sid:903202081; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"45:8d:77:bf:ca:ad:1b:e4:f7:fd:a9:23:a9:4c:16:df:8f:70:01:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/458d77bfcaad1be4f7fda923a94c16df8f700166/; sid:903202082; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"88:ab:c3:45:00:41:ac:f6:80:b5:d7:b0:06:b9:e6:16:90:d8:34:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88abc3450041acf680b5d7b006b9e61690d834bf/; sid:903202083; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (JBifrost C&C)"; tls_cert_fingerprint; content:"7a:99:8d:76:53:10:87:29:3b:25:0f:12:48:b2:a1:66:6e:d9:b2:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a998d76531087293b250f1248b2a1666ed9b2c5/; sid:903202084; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"cf:29:b6:fd:ff:e3:31:5e:8b:60:b6:5d:5e:20:da:ec:c2:a0:70:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf29b6fdffe3315e8b60b65d5e20daecc2a070a4/; sid:903202085; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Qadars C&C)"; tls_cert_fingerprint; content:"7c:5e:e0:9b:5e:3a:16:11:b0:78:7c:a5:08:fd:88:a2:c2:18:59:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c5ee09b5e3a1611b0787ca508fd88a2c21859c0/; sid:903202086; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"54:10:84:4f:fd:3e:3f:c6:5f:1c:a3:b7:90:4f:f2:14:81:92:86:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5410844ffd3e3fc65f1ca3b7904ff2148192867f/; sid:903202087; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"cf:2b:01:49:38:c3:6b:30:f7:d5:77:08:00:3e:d5:e6:7a:ae:f0:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf2b014938c36b30f7d57708003ed5e67aaef0e4/; sid:903202088; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f7:dc:34:b2:bc:79:65:8c:ed:26:b3:4c:ed:f9:70:3d:38:4c:ae:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f7dc34b2bc79658ced26b34cedf9703d384caee5/; sid:903202089; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"74:da:05:6d:eb:7d:d9:a0:ce:fb:80:23:61:4d:54:2b:79:f4:1d:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/74da056deb7dd9a0cefb8023614d542b79f41d01/; sid:903202090; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"89:14:35:7c:ce:21:cb:dc:b4:91:c9:eb:2d:d9:bf:c1:64:ec:55:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8914357cce21cbdcb491c9eb2dd9bfc164ec55d8/; sid:903202091; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"85:a0:9b:fc:48:68:95:2e:02:28:a3:8d:bf:2c:4a:45:c1:9b:4a:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85a09bfc4868952e0228a38dbf2c4a45c19b4a70/; sid:903202092; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8d:b2:f4:77:38:4f:fb:a0:08:b7:7d:54:ea:bf:4d:ab:24:65:46:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8db2f477384ffba008b77d54eabf4dab246546b9/; sid:903202093; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (JBifrost C&C)"; tls_cert_fingerprint; content:"1a:b8:06:97:79:2c:1f:c2:aa:cf:51:3a:69:b4:38:53:67:69:67:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ab80697792c1fc2aacf513a69b43853676967d7/; sid:903202094; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"11:a1:60:3f:74:9e:f5:d4:d4:60:63:4a:d3:ae:6f:c5:7d:44:f5:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11a1603f749ef5d4d460634ad3ae6fc57d44f5ea/; sid:903202095; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ac:f6:72:eb:31:d0:4d:f6:11:cb:94:0b:f6:77:64:ad:73:64:1d:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acf672eb31d04df611cb940bf67764ad73641d22/; sid:903202096; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ab:28:a0:84:e8:89:75:4e:bb:f7:c7:29:e2:f4:ca:85:3e:0e:6b:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab28a084e889754ebbf7c729e2f4ca853e0e6bda/; sid:903202097; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"79:e2:34:30:44:65:ff:5c:76:74:22:34:24:a1:85:a7:0b:c4:52:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79e234304465ff5c7674223424a185a70bc4528a/; sid:903202098; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"66:b3:40:1e:21:f8:77:cc:3c:c2:cd:d8:1d:be:f5:67:ba:ea:72:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66b3401e21f877cc3cc2cdd81dbef567baea72e0/; sid:903202099; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ee:7b:36:e2:e4:54:b4:ea:28:aa:c4:3a:f0:a4:62:11:98:82:3f:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee7b36e2e454b4ea28aac43af0a4621198823fb9/; sid:903202100; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"a5:dc:76:6d:11:83:7f:cf:6e:23:b2:81:a5:c9:c1:02:69:92:59:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a5dc766d11837fcf6e23b281a5c9c102699259e2/; sid:903202101; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"cf:5f:9a:81:4a:7f:14:a8:69:25:13:45:8a:98:c0:86:26:db:31:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf5f9a814a7f14a8692513458a98c08626db3134/; sid:903202102; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"2b:60:bf:5e:1f:05:a4:c8:44:dd:39:35:71:d2:95:9e:56:eb:6c:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b60bf5e1f05a4c844dd393571d2959e56eb6cac/; sid:903202103; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e4:68:83:4d:83:5d:8e:69:d3:f0:04:da:97:0f:be:bd:af:9c:0f:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e468834d835d8e69d3f004da970fbebdaf9c0f5e/; sid:903202104; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"18:d7:78:87:05:5d:be:89:81:28:24:98:74:56:06:df:24:56:fe:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18d77887055dbe8981282498745606df2456fed1/; sid:903202105; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"1e:e1:67:be:7e:c2:15:47:4f:00:57:f2:cd:7b:cb:f6:67:c5:48:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ee167be7ec215474f0057f2cd7bcbf667c548e3/; sid:903202106; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c9:25:3e:41:0b:5e:e3:a3:3d:7e:1c:0e:85:4b:1a:ee:a4:2d:f7:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9253e410b5ee3a33d7e1c0e854b1aeea42df7fe/; sid:903202107; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c9:a6:34:5f:69:10:3f:14:a9:c4:0c:bf:cf:94:80:bd:1c:7a:05:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c9a6345f69103f14a9c40cbfcf9480bd1c7a05b5/; sid:903202108; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"18:0d:c5:df:76:80:cc:83:e7:6d:62:18:d8:63:6e:04:81:9b:75:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/180dc5df7680cc83e76d6218d8636e04819b75f2/; sid:903202109; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"64:f5:70:05:eb:ce:85:29:d1:56:c4:65:eb:19:44:f6:3d:22:87:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64f57005ebce8529d156c465eb1944f63d228711/; sid:903202110; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"20:42:da:83:87:78:90:fc:69:a5:85:1a:9c:a6:6e:23:4f:fd:74:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2042da83877890fc69a5851a9ca66e234ffd7412/; sid:903202111; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"bf:77:fa:07:43:ff:57:04:6b:a6:ca:f9:7d:a5:a4:b3:d2:ef:11:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bf77fa0743ff57046ba6caf97da5a4b3d2ef1112/; sid:903202112; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"75:c2:c8:03:9f:6a:a0:ac:d8:ae:b6:f1:0d:43:77:52:f1:ad:e6:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75c2c8039f6aa0acd8aeb6f10d437752f1ade615/; sid:903202113; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5b:ea:fc:e0:06:a6:c5:57:14:4e:dd:6a:39:9b:cd:fd:af:42:b1:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5beafce006a6c557144edd6a399bcdfdaf42b1f6/; sid:903202114; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"89:df:93:9f:76:db:fc:4c:38:14:72:47:5f:58:04:2c:56:48:1e:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89df939f76dbfc4c381472475f58042c56481e19/; sid:903202115; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"d6:3b:bb:18:43:18:4a:04:8f:df:1f:86:ae:54:ae:31:92:cc:8d:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d63bbb1843184a048fdf1f86ae54ae3192cc8d99/; sid:903202116; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"b8:05:e6:a3:5e:d0:f5:fd:06:42:ea:84:08:2b:84:bf:90:36:ed:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b805e6a35ed0f5fd0642ea84082b84bf9036ede5/; sid:903202117; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"9f:e4:69:5a:08:76:39:ec:e0:02:f5:12:e1:18:ff:18:83:18:6a:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9fe4695a087639ece002f512e118ff1883186ae7/; sid:903202118; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (JBifrost C&C)"; tls_cert_fingerprint; content:"79:25:d9:21:38:30:67:b6:07:17:f7:41:04:02:ae:ef:3b:a7:90:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7925d921383067b60717f7410402aeef3ba7903e/; sid:903202119; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"6e:1e:10:6a:f3:82:0b:4f:98:4e:7e:c8:af:d7:64:39:a3:99:b1:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6e1e106af3820b4f984e7ec8afd76439a399b1f3/; sid:903202120; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"19:33:1a:e7:a5:d4:57:bc:36:2c:88:27:97:93:6e:79:8c:35:bf:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19331ae7a5d457bc362c882797936e798c35bf51/; sid:903202121; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"c5:38:f6:66:92:80:c6:84:96:11:71:a7:60:4f:31:82:57:db:e7:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c538f6669280c684961171a7604f318257dbe789/; sid:903202122; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"44:1b:76:61:e2:b2:01:e4:14:98:0a:51:80:d1:5a:c7:1c:bc:50:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/441b7661e2b201e414980a5180d15ac71cbc50dc/; sid:903202123; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"13:73:e2:0d:48:3e:f2:c2:b3:fe:92:85:ad:34:9b:ca:9f:1b:e2:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1373e20d483ef2c2b3fe9285ad349bca9f1be2d6/; sid:903202124; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7e:1e:d8:8e:eb:98:d5:23:42:2b:bb:f2:2f:0a:7d:cf:a7:90:de:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e1ed88eeb98d523422bbbf22f0a7dcfa790ded4/; sid:903202125; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b6:ea:f9:c4:d0:5b:77:64:87:0d:b1:ed:76:e7:fa:64:8f:ce:28:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6eaf9c4d05b7764870db1ed76e7fa648fce28bd/; sid:903202126; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"68:6c:67:07:7f:27:a8:b0:19:20:db:38:ee:01:6f:4b:49:2a:c0:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/686c67077f27a8b01920db38ee016f4b492ac0a3/; sid:903202127; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"fd:3f:b9:5b:ed:57:fc:03:61:58:d5:c6:ec:3c:25:fb:33:03:56:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd3fb95bed57fc036158d5c6ec3c25fb33035650/; sid:903202128; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c8:ee:ba:31:45:17:38:18:4e:f8:09:39:aa:8f:0b:12:bb:90:f7:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8eeba31451738184ef80939aa8f0b12bb90f784/; sid:903202129; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"46:f1:6d:f3:09:11:fc:3f:3a:ef:08:8d:20:6a:87:32:36:c8:70:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46f16df30911fc3f3aef088d206a873236c870ea/; sid:903202130; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"38:ba:a2:94:04:5f:bf:a1:19:4b:a5:68:10:f8:a1:f2:9d:43:92:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38baa294045fbfa1194ba56810f8a1f29d439268/; sid:903202131; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"10:a7:49:78:fd:77:9e:57:3f:20:82:90:28:86:ba:bf:d4:aa:6c:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10a74978fd779e573f2082902886babfd4aa6c36/; sid:903202132; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"79:aa:b5:0a:24:66:47:98:dc:5f:ab:9e:48:fa:9f:93:63:03:d3:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79aab50a24664798dc5fab9e48fa9f936303d3cf/; sid:903202133; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"2f:73:84:8a:07:6c:43:e3:61:cf:f2:fd:3f:4b:af:e9:87:14:43:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2f73848a076c43e361cff2fd3f4bafe9871443e2/; sid:903202134; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c3:0b:f6:8a:ff:79:89:8c:b1:9e:e7:44:df:b0:07:95:14:48:27:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c30bf68aff79898cb19ee744dfb0079514482782/; sid:903202135; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"21:5a:08:86:f1:b3:d5:fb:66:3a:19:c1:f2:10:17:48:65:84:d0:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/215a0886f1b3d5fb663a19c1f21017486584d034/; sid:903202136; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"57:5a:cb:10:56:e6:e6:89:8c:3f:06:3d:48:04:c6:d7:e9:d6:19:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/575acb1056e6e6898c3f063d4804c6d7e9d619e4/; sid:903202137; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9a:c2:22:95:66:c6:58:62:bb:ec:96:ad:6a:48:f4:27:66:2e:33:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ac2229566c65862bbec96ad6a48f427662e3315/; sid:903202138; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"02:5b:7c:07:b2:77:e9:29:64:79:91:80:e0:8c:79:d9:30:ee:83:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/025b7c07b277e92964799180e08c79d930ee833a/; sid:903202139; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"3f:c4:62:a5:29:a2:35:62:63:aa:c7:2a:bd:1b:51:75:97:b7:5d:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3fc462a529a2356263aac72abd1b517597b75d7c/; sid:903202140; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"28:6e:90:60:9d:cc:a5:8a:00:fc:e4:ee:cf:b0:68:bd:46:82:f1:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/286e90609dcca58a00fce4eecfb068bd4682f1cc/; sid:903202141; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"7c:55:88:f7:2d:85:9a:2b:37:ad:72:f0:72:32:74:a0:fe:49:ec:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c5588f72d859a2b37ad72f0723274a0fe49ec2a/; sid:903202142; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"da:9b:7e:ee:e8:1a:b8:a7:5e:21:cb:60:f3:90:c2:fa:aa:0f:1a:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da9b7eeee81ab8a75e21cb60f390c2faaa0f1a09/; sid:903202143; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7d:2e:9e:8b:18:eb:3e:32:ea:4c:19:73:78:7c:b6:34:05:c2:f7:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d2e9e8b18eb3e32ea4c1973787cb63405c2f77a/; sid:903202144; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c4:0c:61:c5:ea:7b:ce:a5:12:39:59:22:24:42:8d:5a:e7:2d:6b:8c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c40c61c5ea7bcea51239592224428d5ae72d6b8c/; sid:903202145; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"45:1e:a6:1c:dc:99:5a:9c:ef:aa:82:1c:49:0e:42:7c:3a:e2:14:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/451ea61cdc995a9cefaa821c490e427c3ae214c5/; sid:903202146; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"5d:a0:36:f6:ae:0a:02:52:ca:f4:26:1c:6f:ce:95:99:e9:70:71:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5da036f6ae0a0252caf4261c6fce9599e97071b7/; sid:903202147; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"fa:50:4d:7e:a1:66:b6:27:d8:38:38:be:08:b8:08:ea:c9:38:1d:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa504d7ea166b627d83838be08b808eac9381dc6/; sid:903202148; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"14:46:8f:27:7d:ff:9e:73:fc:e6:84:e8:bb:35:04:56:ff:61:5f:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14468f277dff9e73fce684e8bb350456ff615f0b/; sid:903202149; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d5:d9:e5:2e:28:9a:14:87:c0:4a:99:ea:ba:7f:8f:4a:89:16:ae:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d5d9e52e289a1487c04a99eaba7f8f4a8916ae2b/; sid:903202150; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"91:8f:16:c0:92:ce:9f:9b:31:7c:a5:22:f5:0e:fe:06:3c:0d:a1:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/918f16c092ce9f9b317ca522f50efe063c0da17a/; sid:903202151; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"a6:68:71:1d:f4:20:10:83:53:85:14:57:22:bb:42:16:35:fb:5b:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a668711df42010835385145722bb421635fb5bec/; sid:903202152; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"28:86:41:33:d3:c5:33:1f:22:82:d8:66:e3:d5:ff:0c:18:2b:1b:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28864133d3c5331f2282d866e3d5ff0c182b1bad/; sid:903202153; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3f:44:ba:28:bd:f0:3c:75:f1:68:fa:bc:4f:d5:50:7a:1e:4c:84:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3f44ba28bdf03c75f168fabc4fd5507a1e4c84c2/; sid:903202154; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d6:43:57:62:3c:6f:1c:a7:86:1e:78:ed:0b:42:ba:dc:b3:c9:d9:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d64357623c6f1ca7861e78ed0b42badcb3c9d9ba/; sid:903202155; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ac:ee:60:a2:70:36:f5:15:07:cc:39:23:e4:67:b0:53:6f:f8:a0:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acee60a27036f51507cc3923e467b0536ff8a068/; sid:903202156; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"73:b3:88:58:7e:7c:4e:ac:f9:3e:9b:72:fb:89:6f:d9:c1:5e:e4:90"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73b388587e7c4eacf93e9b72fb896fd9c15ee490/; sid:903202157; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7d:91:4e:ee:0d:ea:cb:f6:b4:ea:df:f9:3e:ed:da:6a:54:0a:48:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d914eee0deacbf6b4eadff93eedda6a540a4806/; sid:903202158; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5e:26:4c:b4:fc:21:6d:cd:df:a6:fe:06:c9:0d:8a:dd:74:27:e1:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e264cb4fc216dcddfa6fe06c90d8add7427e13d/; sid:903202159; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"2a:cf:28:c2:20:0b:63:68:05:49:39:6a:73:29:21:ca:97:76:8c:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2acf28c2200b63680549396a732921ca97768c21/; sid:903202160; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"30:3f:a0:84:8c:1a:98:ba:90:b3:c0:74:02:ca:2a:98:5c:4b:89:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/303fa0848c1a98ba90b3c07402ca2a985c4b89d1/; sid:903202161; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"31:6d:cc:56:27:b8:bf:d6:06:57:40:fc:34:e8:86:a7:a1:b1:df:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/316dcc5627b8bfd6065740fc34e886a7a1b1df6b/; sid:903202162; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a9:8f:9d:28:6b:45:b3:9f:30:7b:71:cf:43:a2:5d:0f:75:29:ab:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a98f9d286b45b39f307b71cf43a25d0f7529abb8/; sid:903202163; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ae:7c:42:e5:84:3f:1b:2e:f1:f7:36:3d:27:df:1a:b0:f7:b0:11:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae7c42e5843f1b2ef1f7363d27df1ab0f7b01111/; sid:903202164; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ae:62:5f:32:fa:ec:a9:99:5d:20:19:c0:67:b0:ca:8c:e6:fc:01:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae625f32faeca9995d2019c067b0ca8ce6fc014b/; sid:903202165; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"0d:ea:64:6c:b3:3f:b2:85:b1:2d:a4:34:1c:5f:8b:4c:f4:5a:51:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dea646cb33fb285b12da4341c5f8b4cf45a51fd/; sid:903202166; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ac:7f:51:af:5e:0c:f0:ea:0a:59:b7:e9:6d:43:f4:1e:6f:c5:f6:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac7f51af5e0cf0ea0a59b7e96d43f41e6fc5f60c/; sid:903202167; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5c:b2:4e:0c:ca:a1:31:fb:5d:44:d9:61:9f:e2:ad:3c:91:03:b8:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5cb24e0ccaa131fb5d44d9619fe2ad3c9103b8f5/; sid:903202168; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"03:20:01:68:3d:d0:42:92:ee:9f:88:96:d3:ce:4b:5a:64:be:af:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/032001683dd04292ee9f8896d3ce4b5a64beafb3/; sid:903202169; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"05:a0:30:09:3a:51:41:f5:3b:37:eb:66:84:fa:75:75:be:e0:df:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/05a030093a5141f53b37eb6684fa7575bee0dfab/; sid:903202170; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"fd:a0:59:b2:81:8c:be:1f:7f:03:4f:17:65:ed:3e:6a:d0:e9:2b:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fda059b2818cbe1f7f034f1765ed3e6ad0e92bbf/; sid:903202171; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"b3:d3:72:97:ce:0f:b5:d6:b9:5f:a2:0d:b1:1d:c2:40:8b:4b:73:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b3d37297ce0fb5d6b95fa20db11dc2408b4b7377/; sid:903202172; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f6:54:1a:42:47:de:1d:10:26:53:3a:3a:9b:94:2a:dd:e5:46:92:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f6541a4247de1d1026533a3a9b942adde5469233/; sid:903202173; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b9:bd:55:34:c2:74:a6:70:49:a4:fd:5d:0d:95:d8:28:40:91:60:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b9bd5534c274a67049a4fd5d0d95d82840916044/; sid:903202174; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ac:ac:86:d2:92:b5:3c:83:87:61:25:80:8f:63:a0:a1:b1:ab:72:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acac86d292b53c83876125808f63a0a1b1ab7257/; sid:903202175; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"11:a6:13:0c:1c:d6:c9:4b:43:ec:7d:9e:41:02:61:d0:90:a9:a0:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11a6130c1cd6c94b43ec7d9e410261d090a9a0c8/; sid:903202176; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"f3:71:10:e5:1b:ac:1e:b7:2c:f4:6d:d3:09:bf:85:35:e7:6a:da:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f37110e51bac1eb72cf46dd309bf8535e76ada28/; sid:903202177; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"0a:60:a6:1a:bc:5b:97:be:e9:2a:fb:73:26:2a:37:b9:32:35:f1:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0a60a61abc5b97bee92afb73262a37b93235f147/; sid:903202178; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f4:ef:63:00:b5:cd:5f:96:53:c5:37:d5:0d:39:f0:d6:e1:66:a4:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4ef6300b5cd5f9653c537d50d39f0d6e166a493/; sid:903202179; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"90:06:60:70:8e:65:8a:29:42:57:34:06:79:af:da:71:49:2e:90:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/900660708e658a294257340679afda71492e90ce/; sid:903202180; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"3c:d7:c8:87:08:d5:b0:3c:5f:6a:46:96:9b:70:67:5b:7c:8e:08:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cd7c88708d5b03c5f6a46969b70675b7c8e089b/; sid:903202181; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"03:0b:47:a3:ca:4c:a0:41:de:ab:48:46:b3:a5:89:a5:d4:01:57:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/030b47a3ca4ca041deab4846b3a589a5d40157db/; sid:903202182; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"99:40:ac:e3:d2:fb:71:d9:ee:07:fb:a8:81:f5:b7:e1:ef:b5:88:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9940ace3d2fb71d9ee07fba881f5b7e1efb58830/; sid:903202183; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"66:d0:0f:b9:dd:dd:f5:50:1c:e7:20:fe:9a:c4:91:f7:48:53:98:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66d00fb9ddddf5501ce720fe9ac491f748539886/; sid:903202184; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"32:e3:a5:5c:af:2d:8b:e8:87:e5:7f:a9:89:6f:0b:74:98:c8:c5:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32e3a55caf2d8be887e57fa9896f0b7498c8c5b3/; sid:903202185; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3d:31:4a:f3:95:55:97:24:45:6b:60:1f:e7:75:ce:6e:b9:13:72:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3d314af395559724456b601fe775ce6eb9137212/; sid:903202186; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"20:7c:6e:0b:8d:94:71:ec:2e:3d:52:0f:a5:01:11:39:22:4d:00:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/207c6e0b8d9471ec2e3d520fa5011139224d009d/; sid:903202187; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"bc:cd:88:ae:63:c3:96:58:e7:a5:a3:fc:35:11:dc:7b:ee:29:38:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bccd88ae63c39658e7a5a3fc3511dc7bee2938c9/; sid:903202188; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b5:fb:3b:5d:ed:e3:80:b1:40:8c:ec:eb:2f:86:bf:96:dd:3d:1d:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5fb3b5dede380b1408ceceb2f86bf96dd3d1d52/; sid:903202189; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a9:49:d4:6c:29:a8:7d:82:5e:d5:c2:52:0d:67:9b:3f:df:02:14:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a949d46c29a87d825ed5c2520d679b3fdf0214c4/; sid:903202190; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"d5:23:80:91:8a:07:32:2c:50:f1:bf:a2:b4:3a:f3:bb:54:cb:33:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d52380918a07322c50f1bfa2b43af3bb54cb33db/; sid:903202191; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"25:21:02:a8:db:bf:30:c6:eb:05:7c:df:5c:76:a9:7e:e5:74:a9:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/252102a8dbbf30c6eb057cdf5c76a97ee574a999/; sid:903202192; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"97:be:a2:f2:4d:92:08:a3:14:ef:bb:88:6a:c0:79:1b:d0:00:b6:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97bea2f24d9208a314efbb886ac0791bd000b608/; sid:903202193; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c0:fd:b6:f6:f8:69:ec:69:22:de:63:9c:58:6b:6c:ea:95:dc:9e:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0fdb6f6f869ec6922de639c586b6cea95dc9edb/; sid:903202194; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"83:05:cb:9f:39:63:8d:ad:87:bb:c1:bf:b8:4f:8d:e1:63:0e:2b:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8305cb9f39638dad87bbc1bfb84f8de1630e2b32/; sid:903202195; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"25:13:f1:d9:b8:4f:88:d6:46:f4:85:39:1c:d7:22:f3:23:29:5c:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2513f1d9b84f88d646f485391cd722f323295c93/; sid:903202196; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"65:4d:4f:33:b1:fb:15:02:0e:de:87:0d:e6:d3:d7:d4:38:ea:25:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/654d4f33b1fb15020ede870de6d3d7d438ea2506/; sid:903202197; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"b2:3d:e8:95:08:4a:da:8f:64:8f:af:ea:cf:c5:1b:2b:3f:ab:59:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b23de895084ada8f648fafeacfc51b2b3fab592b/; sid:903202198; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"94:43:34:58:d4:ad:93:00:f1:ee:8d:3f:e9:00:7c:a1:1b:5e:20:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94433458d4ad9300f1ee8d3fe9007ca11b5e20cd/; sid:903202199; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"2f:6e:ce:78:97:cf:e2:06:74:90:a2:7d:0a:01:55:21:2e:7c:94:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2f6ece7897cfe2067490a27d0a0155212e7c94fc/; sid:903202200; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"aa:23:78:53:43:96:5f:2e:0c:82:31:fa:57:64:ea:15:82:2e:93:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa23785343965f2e0c8231fa5764ea15822e9376/; sid:903202201; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"8d:88:67:de:05:fb:e3:a5:9d:49:a9:19:e8:f4:9f:09:62:8c:c0:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d8867de05fbe3a59d49a919e8f49f09628cc0a5/; sid:903202202; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"e3:07:da:6d:d8:4b:a9:21:de:22:18:1e:13:bf:8f:d4:01:e3:54:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e307da6dd84ba921de22181e13bf8fd401e354d7/; sid:903202203; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"4c:ee:86:a4:a3:df:fe:67:ff:90:dc:30:e4:dd:76:92:fb:a2:d1:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4cee86a4a3dffe67ff90dc30e4dd7692fba2d1dd/; sid:903202204; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"fc:9f:19:19:30:f0:f5:eb:e7:fc:88:8d:f9:59:33:8d:57:45:5a:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc9f191930f0f5ebe7fc888df959338d57455a1d/; sid:903202205; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5b:00:23:7b:d2:09:bf:77:8c:a8:dd:46:7d:d6:44:d0:2e:fc:a5:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b00237bd209bf778ca8dd467dd644d02efca5aa/; sid:903202206; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2b:ed:ff:8e:51:9f:e4:0b:33:77:d7:a2:85:46:21:f0:38:e1:60:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2bedff8e519fe40b3377d7a2854621f038e16093/; sid:903202207; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ff:21:8c:49:25:14:12:42:8f:0b:d1:2d:d4:18:c7:60:6f:51:07:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff218c49251412428f0bd12dd418c7606f5107fe/; sid:903202208; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6e:dd:06:f7:1b:b8:68:a3:e7:21:f6:60:39:05:c1:45:ab:97:79:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6edd06f71bb868a3e721f6603905c145ab97790c/; sid:903202209; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"2e:97:74:5a:a3:04:af:85:b4:7e:ea:3d:f6:fa:84:e0:15:c4:e1:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e97745aa304af85b47eea3df6fa84e015c4e160/; sid:903202210; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"0b:e8:6a:6f:0a:79:c0:f3:a3:20:34:c2:1c:7d:cf:a1:59:ad:5d:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0be86a6f0a79c0f3a32034c21c7dcfa159ad5d45/; sid:903202211; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"7d:3a:d8:cc:c7:48:e0:a3:40:d5:c5:9a:86:de:52:50:6e:57:7a:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d3ad8ccc748e0a340d5c59a86de52506e577a40/; sid:903202212; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"a8:00:e5:b1:86:ed:5c:21:02:b7:97:65:a4:d3:24:55:b4:f3:65:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a800e5b186ed5c2102b79765a4d32455b4f3658e/; sid:903202213; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"60:a7:81:30:c2:0e:36:bf:18:9a:8a:0b:46:51:28:9f:aa:cd:64:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60a78130c20e36bf189a8a0b4651289faacd646b/; sid:903202214; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"2b:08:3b:95:2d:9a:7a:22:d1:15:78:cd:d6:ad:37:a4:96:ea:2a:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b083b952d9a7a22d11578cdd6ad37a496ea2a06/; sid:903202215; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"eb:fd:61:5c:3c:e5:d9:87:49:b6:4a:7c:f6:76:fb:a0:00:0d:57:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ebfd615c3ce5d98749b64a7cf676fba0000d572c/; sid:903202216; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"43:8f:8a:f4:14:25:5d:74:91:1a:c7:18:34:77:a4:23:98:96:90:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/438f8af414255d74911ac7183477a42398969010/; sid:903202217; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"3a:b4:d6:e9:7e:c2:6d:1a:b1:94:f4:4f:19:68:ec:cd:35:fc:66:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ab4d6e97ec26d1ab194f44f1968eccd35fc66ae/; sid:903202218; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"b8:82:8d:aa:fe:02:24:d6:de:45:7e:d1:a5:26:a3:80:0a:ce:57:ab"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b8828daafe0224d6de457ed1a526a3800ace57ab/; sid:903202219; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"cd:b5:48:ca:de:0a:fb:9d:70:da:a7:fa:c4:3a:51:fd:23:04:85:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cdb548cade0afb9d70daa7fac43a51fd23048540/; sid:903202220; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"de:ec:a2:35:54:54:61:30:16:3a:a4:eb:0b:71:80:93:a1:6f:b1:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/deeca23554546130163aa4eb0b718093a16fb13a/; sid:903202221; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"dd:b4:ab:26:04:42:73:f7:c6:1e:90:bd:a2:ac:c0:c7:84:0f:1f:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddb4ab26044273f7c61e90bda2acc0c7840f1f79/; sid:903202222; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"c2:da:79:a6:fe:70:3c:e9:6c:e6:3f:64:46:f8:9e:29:9f:99:84:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c2da79a6fe703ce96ce63f6446f89e299f998494/; sid:903202223; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"12:45:6b:42:c1:9d:9b:11:6a:e5:77:6f:74:48:95:1f:c2:ca:1b:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12456b42c19d9b116ae5776f7448951fc2ca1baa/; sid:903202224; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c7:7c:c4:9c:34:2e:46:3c:d6:48:9c:76:5f:ca:ef:0b:22:77:3f:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c77cc49c342e463cd6489c765fcaef0b22773f96/; sid:903202225; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"36:49:e6:5d:15:47:27:db:2f:70:e6:a8:45:73:b1:01:f9:de:bb:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3649e65d154727db2f70e6a84573b101f9debb7e/; sid:903202226; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"18:3e:70:3a:4e:55:99:a2:2a:a0:d5:63:ee:d4:9e:0d:47:b7:64:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/183e703a4e5599a22aa0d563eed49e0d47b7640f/; sid:903202227; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"8c:82:e0:b1:f1:63:bb:f4:71:7d:f8:f7:fd:69:83:00:aa:21:9c:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c82e0b1f163bbf4717df8f7fd698300aa219c07/; sid:903202228; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"00:c2:e0:37:5f:9b:44:ba:19:15:9a:88:2a:24:3d:f3:20:47:5a:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00c2e0375f9b44ba19159a882a243df320475a60/; sid:903202229; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"3e:40:b5:8f:2c:7a:fa:5c:10:aa:bf:58:fa:64:c6:d1:5d:fa:e2:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e40b58f2c7afa5c10aabf58fa64c6d15dfae2a8/; sid:903202230; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"3d:aa:7c:bc:b2:16:c8:3a:04:1a:89:b3:2d:96:7a:8e:20:f9:47:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3daa7cbcb216c83a041a89b32d967a8e20f9479d/; sid:903202231; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"dd:a8:ad:6d:9d:7c:84:76:a5:ad:d6:bc:37:a3:ea:b1:f5:e4:6c:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dda8ad6d9d7c8476a5add6bc37a3eab1f5e46c9c/; sid:903202232; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"5d:89:88:a9:f4:06:b0:77:f2:bf:4c:be:db:cc:dc:07:34:54:53:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d8988a9f406b077f2bf4cbedbccdc07345453d6/; sid:903202233; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"a4:98:70:5d:59:fd:fb:e6:6f:67:fb:47:9b:42:e9:0e:fc:cc:f9:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a498705d59fdfbe66f67fb479b42e90efcccf9d7/; sid:903202234; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"2a:21:fd:57:c3:aa:86:5a:c9:cf:a6:fe:6a:08:43:d0:07:2a:a1:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a21fd57c3aa865ac9cfa6fe6a0843d0072aa18b/; sid:903202235; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"89:90:75:9b:cb:b9:ed:72:cc:b0:16:07:4e:89:f8:cf:d7:68:f6:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8990759bcbb9ed72ccb016074e89f8cfd768f62a/; sid:903202236; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"90:65:1b:6c:ee:66:22:95:34:5a:e9:1d:8e:c5:07:02:fa:bc:ae:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/90651b6cee662295345ae91d8ec50702fabcaee3/; sid:903202237; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"aa:3c:5a:4d:93:06:67:db:cb:38:a5:02:db:7a:25:09:a8:aa:95:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa3c5a4d930667dbcb38a502db7a2509a8aa95da/; sid:903202238; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"3a:57:b9:f0:8a:00:8f:b3:8b:0a:63:db:33:b8:43:32:7c:c8:87:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a57b9f08a008fb38b0a63db33b843327cc88775/; sid:903202239; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0e:1f:2e:f3:c4:59:c7:4c:6d:8e:76:eb:bf:bf:54:c3:c6:93:54:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e1f2ef3c459c74c6d8e76ebbfbf54c3c69354de/; sid:903202240; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"77:48:70:24:0b:62:a8:95:61:2d:50:05:d6:9b:c3:91:4f:99:02:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/774870240b62a895612d5005d69bc3914f9902d1/; sid:903202241; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c7:5e:cf:9e:cc:51:be:d8:68:45:0f:a6:d0:0b:c6:61:35:80:0c:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c75ecf9ecc51bed868450fa6d00bc66135800c9d/; sid:903202242; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"75:7e:c4:39:a7:69:e6:9a:74:b1:21:1e:6a:e5:79:28:d7:ea:f3:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/757ec439a769e69a74b1211e6ae57928d7eaf351/; sid:903202243; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"8c:ea:e1:72:60:75:a4:d1:69:07:64:fd:72:ed:55:b6:7a:5b:df:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ceae1726075a4d1690764fd72ed55b67a5bdf84/; sid:903202244; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b6:2f:a5:a0:a6:c3:85:b3:88:f9:1f:08:e1:75:9f:2f:a3:52:95:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b62fa5a0a6c385b388f91f08e1759f2fa35295c5/; sid:903202245; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ea:5e:48:94:6d:37:e5:d0:c4:56:bc:68:b0:90:61:67:16:f2:71:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ea5e48946d37e5d0c456bc68b090616716f27145/; sid:903202246; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"3b:37:25:dd:24:b8:bc:46:8c:e3:8b:ca:b7:69:21:00:b5:85:50:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b3725dd24b8bc468ce38bcab7692100b5855077/; sid:903202247; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"19:df:51:91:5f:bd:54:62:26:fb:ad:59:81:b3:b6:79:98:82:44:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19df51915fbd546226fbad5981b3b67998824486/; sid:903202248; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5f:70:ec:dd:48:a4:9c:35:69:b5:cf:51:b1:78:ef:9d:be:42:82:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f70ecdd48a49c3569b5cf51b178ef9dbe4282d0/; sid:903202249; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7a:cd:43:e7:e4:60:07:f4:93:a8:c0:f7:d9:8d:4a:51:60:46:38:de"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7acd43e7e46007f493a8c0f7d98d4a51604638de/; sid:903202250; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"52:db:5a:ab:62:99:a4:fb:57:f3:69:83:bc:fd:e6:79:3a:bd:56:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52db5aab6299a4fb57f36983bcfde6793abd5687/; sid:903202251; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"97:f8:b6:68:7a:b0:3d:2e:f5:b3:ea:9d:24:95:e2:8a:bf:2f:e9:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/97f8b6687ab03d2ef5b3ea9d2495e28abf2fe9d8/; sid:903202252; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5c:2d:86:ce:d0:61:c6:7f:f0:72:e2:9c:bc:67:44:75:da:20:e4:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c2d86ced061c67ff072e29cbc674475da20e486/; sid:903202253; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"64:45:58:13:ff:85:64:4f:57:2f:f2:70:13:af:d5:bc:f9:cf:d1:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64455813ff85644f572ff27013afd5bcf9cfd116/; sid:903202254; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7d:0f:8a:9e:44:be:f4:e3:cd:20:4c:16:9e:a1:6f:9c:36:02:c7:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d0f8a9e44bef4e3cd204c169ea16f9c3602c710/; sid:903202255; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"7b:78:42:50:8e:74:b0:a6:c2:b8:4f:71:18:ee:4e:a7:3d:0d:d1:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b7842508e74b0a6c2b84f7118ee4ea73d0dd12a/; sid:903202256; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"18:4b:3b:c4:da:e2:04:ae:dc:16:b4:82:a7:a5:da:42:1f:ae:fa:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/184b3bc4dae204aedc16b482a7a5da421faefa31/; sid:903202257; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"7a:5d:fe:85:e0:8a:d5:1b:28:aa:62:82:74:02:7d:f3:67:19:9f:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a5dfe85e08ad51b28aa628274027df367199fd4/; sid:903202258; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"fa:b9:d1:5d:8f:2e:ad:bb:8f:75:bc:ce:15:2e:1c:c7:d7:3e:d8:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fab9d15d8f2eadbb8f75bcce152e1cc7d73ed8da/; sid:903202259; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Downloader.AuotIT.ZLIB C&C)"; tls_cert_fingerprint; content:"6c:b5:27:f1:c6:b5:a6:cf:41:eb:34:d3:41:36:a5:44:5e:57:df:40"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cb527f1c6b5a6cf41eb34d34136a5445e57df40/; sid:903202260; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Downloader.AuotIT.ZLIB C&C)"; tls_cert_fingerprint; content:"03:e6:bd:14:e1:00:d4:1b:68:d6:c4:0e:45:bb:f7:1f:f7:3c:62:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/03e6bd14e100d41b68d6c40e45bbf71ff73c6274/; sid:903202261; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (LockPOS C&C)"; tls_cert_fingerprint; content:"dc:81:8e:71:e0:55:8b:0b:a3:62:57:71:c8:04:56:d9:32:d4:5b:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc818e71e0558b0ba3625771c80456d932d45b0e/; sid:903202262; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"28:e2:71:dc:3d:86:eb:53:0e:78:d6:c0:5d:a2:30:3a:49:16:98:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28e271dc3d86eb530e78d6c05da2303a491698ca/; sid:903202263; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"da:ad:d8:8d:8e:e8:a1:e2:71:9b:df:5d:38:6c:74:4f:93:eb:c0:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/daadd88d8ee8a1e2719bdf5d386c744f93ebc025/; sid:903202264; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"20:7a:31:fb:22:bd:e2:b2:36:d3:6b:d4:64:76:22:06:4e:fc:dd:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/207a31fb22bde2b236d36bd4647622064efcdd6a/; sid:903202265; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"80:20:18:d0:95:0e:da:31:a3:04:f4:2c:25:e7:74:3a:a3:9a:2a:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/802018d0950eda31a304f42c25e7743aa39a2ab5/; sid:903202266; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"31:d2:d9:13:ea:30:5d:df:a3:c2:75:18:4f:3d:13:86:27:a0:c8:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31d2d913ea305ddfa3c275184f3d138627a0c86e/; sid:903202267; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"9d:00:d6:2b:06:a9:7c:1e:43:97:50:ed:2c:5d:44:c3:03:68:32:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d00d62b06a97c1e439750ed2c5d44c303683202/; sid:903202268; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"51:9a:f4:00:67:c7:19:74:9b:86:26:47:9f:ac:81:c1:4e:24:8b:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/519af40067c719749b8626479fac81c14e248b48/; sid:903202269; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"af:c8:d1:19:ca:d2:f1:17:7e:1c:51:24:81:53:cb:26:a3:67:cd:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/afc8d119cad2f1177e1c51248153cb26a367cdbf/; sid:903202270; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c8:a2:37:c9:07:b3:3e:e1:e3:43:1c:45:d3:ab:dd:76:f9:6f:8e:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8a237c907b33ee1e3431c45d3abdd76f96f8e43/; sid:903202271; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"fc:f5:7e:83:1a:5f:e8:34:b0:cd:25:40:d1:c1:9a:f7:1b:af:21:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fcf57e831a5fe834b0cd2540d1c19af71baf21a1/; sid:903202272; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"60:2c:5d:ba:d0:7f:d4:c9:82:5a:2d:fc:16:04:46:49:7c:39:6b:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/602c5dbad07fd4c9825a2dfc160446497c396bbd/; sid:903202273; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"0c:d0:5b:b4:3a:7b:af:3f:5c:07:76:0b:f6:d1:7c:cc:9d:e0:bb:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0cd05bb43a7baf3f5c07760bf6d17ccc9de0bb19/; sid:903202274; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c8:80:92:cf:53:2a:46:b3:c9:fa:bd:ff:63:61:f8:a3:38:b7:d2:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c88092cf532a46b3c9fabdff6361f8a338b7d292/; sid:903202275; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"70:2d:01:5c:52:0f:d5:b7:6e:e7:ed:49:b3:8f:88:92:37:2a:c5:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/702d015c520fd5b76ee7ed49b38f8892372ac54f/; sid:903202276; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"a4:8f:cb:66:3d:e8:db:ba:dc:d1:7b:8f:83:6e:2c:5d:4e:d3:b3:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a48fcb663de8dbbadcd17b8f836e2c5d4ed3b330/; sid:903202277; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ec:18:e0:40:6f:3e:af:a3:ee:d3:ca:ff:61:f5:9e:2e:5c:e2:6f:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec18e0406f3eafa3eed3caff61f59e2e5ce26fff/; sid:903202278; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d0:f1:70:91:24:4f:89:2e:a2:7a:ac:d3:d6:4a:dc:b9:82:28:32:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0f17091244f892ea27aacd3d64adcb9822832b4/; sid:903202279; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"9b:58:5b:40:14:ef:6c:c5:ea:bc:23:5f:63:b8:1a:01:b6:a7:d0:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9b585b4014ef6cc5eabc235f63b81a01b6a7d091/; sid:903202280; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ac:e9:4d:19:d9:d7:8c:91:5d:9e:e0:80:bf:60:cd:41:ac:8d:b9:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ace94d19d9d78c915d9ee080bf60cd41ac8db91a/; sid:903202281; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d1:97:58:7b:bc:14:5b:81:eb:2e:ac:5b:06:7f:02:7f:3d:17:d0:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d197587bbc145b81eb2eac5b067f027f3d17d0c3/; sid:903202282; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"eb:d9:95:19:da:72:87:3a:e0:3f:92:10:99:6f:49:af:6b:16:9f:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ebd99519da72873ae03f9210996f49af6b169fa0/; sid:903202283; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"7e:2f:eb:5c:7e:af:88:0e:85:87:b3:49:d3:de:e9:4a:77:65:0d:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e2feb5c7eaf880e8587b349d3dee94a77650dd4/; sid:903202284; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"22:c5:ec:e6:63:9c:9c:ed:35:d6:a2:d4:5d:7d:c1:8f:9d:4f:52:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22c5ece6639c9ced35d6a2d45d7dc18f9d4f5256/; sid:903202285; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"58:ae:ab:46:c6:cd:fe:c4:66:7f:68:3e:d1:5b:84:d5:41:51:38:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/58aeab46c6cdfec4667f683ed15b84d541513857/; sid:903202286; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"cb:06:cd:0c:dd:50:db:37:64:7e:44:4a:9a:09:2f:fc:3a:29:8e:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb06cd0cdd50db37647e444a9a092ffc3a298e95/; sid:903202287; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"d0:35:1b:59:fd:d6:e8:2b:26:07:80:f2:b6:0c:15:6e:25:30:3f:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0351b59fdd6e82b260780f2b60c156e25303fa4/; sid:903202288; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6a:d7:1b:16:3c:fc:3a:a1:cf:0c:fd:78:6d:87:fd:1b:19:8d:a3:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ad71b163cfc3aa1cf0cfd786d87fd1b198da3ba/; sid:903202289; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d2:e3:57:14:1d:f5:39:27:5a:b0:47:e7:d7:a6:7f:f8:60:cf:21:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2e357141df539275ab047e7d7a67ff860cf2168/; sid:903202290; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Cobalt C&C)"; tls_cert_fingerprint; content:"85:14:71:ad:80:3a:2d:58:30:2c:e4:e7:09:1b:84:45:64:43:62:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/851471ad803a2d58302ce4e7091b84456443626e/; sid:903202291; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"64:7c:00:a1:f7:27:bb:2f:1c:97:55:3d:4f:4b:a4:b5:18:42:ec:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/647c00a1f727bb2f1c97553d4f4ba4b51842ec74/; sid:903202292; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"a8:27:af:b8:a4:f4:6d:06:63:7a:ac:05:6e:a3:91:3f:bc:ab:d8:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a827afb8a4f46d06637aac056ea3913fbcabd8bc/; sid:903202293; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"d5:56:70:35:30:c7:b2:fa:bb:80:22:a7:77:fb:ff:fd:fc:95:b1:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d556703530c7b2fabb8022a777fbfffdfc95b16c/; sid:903202294; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e2:49:94:e2:fb:a3:df:ef:bf:f7:6e:35:ea:37:b9:b8:83:bf:10:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e24994e2fba3dfefbff76e35ea37b9b883bf1034/; sid:903202295; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"32:e2:ff:19:c0:9a:bb:cd:b5:64:94:25:ad:67:39:e9:1c:94:69:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32e2ff19c09abbcdb5649425ad6739e91c946923/; sid:903202296; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"3c:f1:90:53:ae:2a:f4:c1:c3:87:45:d8:42:33:ea:f9:65:d9:31:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3cf19053ae2af4c1c38745d84233eaf965d93187/; sid:903202297; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Cobalt C&C)"; tls_cert_fingerprint; content:"c6:e4:22:fd:5f:59:9e:ce:5d:0e:d6:51:12:00:5b:f2:18:92:ca:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6e422fd5f599ece5d0ed65112005bf21892ca16/; sid:903202298; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"52:5d:2e:f8:df:f4:e7:21:19:ce:cb:76:47:48:28:5c:53:f2:13:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/525d2ef8dff4e72119cecb764748285c53f21327/; sid:903202299; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"61:c6:d4:d5:ef:7a:ef:36:27:58:97:d6:63:5b:b7:a5:8a:3e:5b:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/61c6d4d5ef7aef36275897d6635bb7a58a3e5b11/; sid:903202300; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"aa:aa:54:9e:6e:6c:d5:23:3a:22:8b:4c:bb:72:06:a7:59:da:f4:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aaaa549e6e6cd5233a228b4cbb7206a759daf4cb/; sid:903202301; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"aa:6a:2c:1d:61:be:29:34:08:a1:bd:aa:f3:da:51:da:49:c5:42:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa6a2c1d61be293408a1bdaaf3da51da49c542e1/; sid:903202302; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Cobalt C&C)"; tls_cert_fingerprint; content:"39:47:d0:e9:fd:01:c4:85:ed:0b:61:66:2b:8f:69:93:fc:c4:26:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3947d0e9fd01c485ed0b61662b8f6993fcc4267c/; sid:903202303; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"4e:38:b2:76:fb:2d:3a:de:de:ee:50:ed:3a:a0:c0:d8:65:89:e2:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e38b276fb2d3adedeee50ed3aa0c0d86589e24c/; sid:903202304; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"31:84:0e:a2:8e:21:e9:9c:1e:5c:8d:48:3b:20:da:aa:07:78:bb:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31840ea28e21e99c1e5c8d483b20daaa0778bb76/; sid:903202305; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"4d:86:1b:8a:86:50:e3:e6:f1:45:e4:7d:a8:ea:2d:cc:7b:d4:38:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d861b8a8650e3e6f145e47da8ea2dcc7bd43883/; sid:903202306; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6f:08:c9:6d:d7:cf:c5:da:1b:89:aa:9b:76:2a:91:3c:ea:f1:72:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f08c96dd7cfc5da1b89aa9b762a913ceaf17252/; sid:903202307; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"55:ab:bf:41:5e:48:51:92:b1:bb:1f:df:7e:d1:21:2d:c9:86:c3:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55abbf415e485192b1bb1fdf7ed1212dc986c351/; sid:903202308; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"54:6d:66:a7:23:cf:6c:45:86:cf:04:13:f1:69:59:7c:35:86:39:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/546d66a723cf6c4586cf0413f169597c3586394f/; sid:903202309; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"74:3e:be:f6:94:16:d4:29:93:76:37:b2:1b:b6:2e:39:32:71:50:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/743ebef69416d429937637b21bb62e393271500d/; sid:903202310; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"4c:8d:70:ec:7e:fb:4b:38:06:ef:1e:86:49:dc:9f:47:38:a2:7c:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c8d70ec7efb4b3806ef1e8649dc9f4738a27c98/; sid:903202311; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"e9:fb:f9:ce:3a:3e:ea:7b:a2:bd:ad:ba:b1:63:cf:f2:14:8d:c9:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9fbf9ce3a3eea7ba2bdadbab163cff2148dc9e7/; sid:903202312; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"01:be:74:65:68:57:6d:7a:ec:ee:c8:ee:6d:07:49:f1:26:0c:d6:86"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01be746568576d7aeceec8ee6d0749f1260cd686/; sid:903202313; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"1a:b8:0a:1e:be:ce:5e:ad:35:b6:8e:2c:19:eb:ce:ef:6e:43:18:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1ab80a1ebece5ead35b68e2c19ebceef6e431888/; sid:903202314; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f6:2a:9d:0d:ba:6d:39:84:67:f3:7a:e8:e2:72:d6:c2:69:d7:eb:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f62a9d0dba6d398467f37ae8e272d6c269d7eb5d/; sid:903202315; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"00:39:61:d4:a2:37:13:54:b2:33:80:86:97:cd:ad:4d:66:07:92:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/003961d4a2371354b233808697cdad4d660792a9/; sid:903202316; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"88:65:fb:17:f0:50:fc:ea:17:4f:4b:cc:68:b9:b5:33:9e:b6:98:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8865fb17f050fcea174f4bcc68b9b5339eb698d3/; sid:903202317; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"86:fe:3f:99:8c:40:05:17:67:e9:54:27:66:12:9e:83:33:65:24:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86fe3f998c40051767e9542766129e833365241f/; sid:903202318; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"05:6d:df:72:0a:ab:43:45:0b:83:17:87:52:72:6e:82:76:1f:e3:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/056ddf720aab43450b83178752726e82761fe316/; sid:903202319; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuantLoader C&C)"; tls_cert_fingerprint; content:"a7:1f:89:9a:de:ab:0b:88:22:2b:81:66:c3:a6:53:6d:20:2a:2d:02"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a71f899adeab0b88222b8166c3a6536d202a2d02/; sid:903202320; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuantLoader C&C)"; tls_cert_fingerprint; content:"c1:2e:c7:ea:70:46:33:70:31:ee:6a:17:77:f7:9d:ba:21:98:de:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c12ec7ea7046337031ee6a1777f79dba2198def6/; sid:903202321; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"8d:e9:dd:b6:34:ef:d8:33:ad:59:c3:55:9a:13:56:79:91:e5:05:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8de9ddb634efd833ad59c3559a13567991e50537/; sid:903202322; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"79:22:7e:b9:43:4e:ac:83:89:a5:f9:0e:01:92:be:72:4c:aa:93:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79227eb9434eac8389a5f90e0192be724caa93dd/; sid:903202323; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Trickbot C&C)"; tls_cert_fingerprint; content:"b7:8f:93:23:15:e7:35:74:78:de:18:c1:d6:f0:9b:25:46:ec:3a:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b78f932315e7357478de18c1d6f09b2546ec3a1c/; sid:903202324; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Trickbot C&C)"; tls_cert_fingerprint; content:"d1:3b:d2:30:b6:96:f6:c3:bb:65:b5:a0:f1:99:fd:5c:58:79:2c:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d13bd230b696f6c3bb65b5a0f199fd5c58792c21/; sid:903202325; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"9e:61:f8:d9:2b:30:38:85:d9:cb:6f:27:8d:0d:44:3e:11:ad:8c:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e61f8d92b303885d9cb6f278d0d443e11ad8ca7/; sid:903202326; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c0:4a:0f:b7:bc:2f:61:fd:ce:c6:d2:ec:e8:fd:d1:13:48:3a:32:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c04a0fb7bc2f61fdcec6d2ece8fdd113483a323a/; sid:903202327; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"bd:83:72:81:6e:fa:5a:4e:ac:bd:26:a1:25:04:6f:08:86:c8:3f:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bd8372816efa5a4eacbd26a125046f0886c83f35/; sid:903202328; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"0a:82:03:9c:bc:71:8b:67:3e:0b:0c:34:1d:4a:96:01:d9:e8:59:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0a82039cbc718b673e0b0c341d4a9601d9e859a1/; sid:903202329; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"cf:fb:49:20:8d:80:e6:51:99:2f:22:66:5a:06:e8:fc:f9:85:ab:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cffb49208d80e651992f22665a06e8fcf985ab82/; sid:903202330; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"0a:af:e0:6c:86:f4:d2:02:80:47:85:05:37:19:f7:59:5d:a5:14:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0aafe06c86f4d202804785053719f7595da514b9/; sid:903202331; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Corebot C&C)"; tls_cert_fingerprint; content:"be:0b:4d:fe:e0:a2:05:15:a3:0d:e2:5b:22:d1:65:a4:3d:fb:c0:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/be0b4dfee0a20515a30de25b22d165a43dfbc07c/; sid:903202332; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"be:bb:7c:da:06:10:e6:20:4f:29:41:c3:79:23:3a:c1:22:aa:b9:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bebb7cda0610e6204f2941c379233ac122aab973/; sid:903202333; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"12:f3:ea:9d:65:4d:ee:a6:79:ad:ba:bd:27:62:1b:fc:d2:bb:aa:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12f3ea9d654deea679adbabd27621bfcd2bbaa33/; sid:903202334; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"48:6a:af:c0:05:8f:f1:5e:08:0c:ed:c5:49:d0:f6:0d:64:fb:91:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/486aafc0058ff15e080cedc549d0f60d64fb91c1/; sid:903202335; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ac:c7:46:d6:17:42:cb:bd:58:3f:a5:1d:78:ab:af:53:7c:fe:00:47"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acc746d61742cbbd583fa51d78abaf537cfe0047/; sid:903202336; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c8:e6:7f:61:65:a5:63:14:8e:d0:16:93:a8:66:d2:ea:e1:29:0d:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8e67f6165a563148ed01693a866d2eae1290d7b/; sid:903202337; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"93:e1:0a:63:a8:4e:81:e0:b4:6d:39:fe:3c:8a:26:c5:a9:c9:db:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93e10a63a84e81e0b46d39fe3c8a26c5a9c9db53/; sid:903202338; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"1f:ba:b9:e8:de:c5:23:3a:fb:48:0e:a9:e3:ac:e7:be:c1:dc:98:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1fbab9e8dec5233afb480ea9e3ace7bec1dc98bf/; sid:903202339; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b5:cd:58:78:a1:45:3a:a7:da:65:47:88:76:b3:be:a9:dd:f6:d4:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5cd5878a1453aa7da65478876b3bea9ddf6d479/; sid:903202340; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e1:38:df:e9:37:25:44:81:ad:5c:47:b0:7d:c8:9c:b2:c4:7b:12:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e138dfe937254481ad5c47b07dc89cb2c47b12f3/; sid:903202341; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"24:bb:be:14:7a:1a:29:41:f7:0a:4f:6e:60:ea:87:76:0f:d0:6f:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24bbbe147a1a2941f70a4f6e60ea87760fd06f06/; sid:903202342; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"25:1a:9d:f4:15:e2:a8:1e:93:97:94:53:ef:1a:88:74:f7:5d:70:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/251a9df415e2a81e93979453ef1a8874f75d70fc/; sid:903202343; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"ee:4d:64:11:bc:8a:56:61:07:56:ec:f6:c8:22:17:df:c9:60:85:28"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee4d6411bc8a56610756ecf6c82217dfc9608528/; sid:903202344; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"10:10:97:81:26:8c:e3:d9:43:1e:0a:8d:08:86:b9:44:00:bf:ce:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10109781268ce3d9431e0a8d0886b94400bfced3/; sid:903202345; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4f:67:8d:31:85:86:38:1a:77:22:e5:fd:88:14:5e:91:e7:b3:0d:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4f678d318586381a7722e5fd88145e91e7b30d2c/; sid:903202346; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"43:fb:e0:db:76:3d:3d:6e:37:09:ac:8a:7b:46:69:e4:b3:d8:e5:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43fbe0db763d3d6e3709ac8a7b4669e4b3d8e5ee/; sid:903202347; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"16:55:05:c9:54:ef:9c:18:2b:5d:ba:eb:98:83:4b:3d:50:25:bb:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/165505c954ef9c182b5dbaeb98834b3d5025bb31/; sid:903202348; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Smoke Loader C&C)"; tls_cert_fingerprint; content:"65:c0:c1:06:19:ca:af:5d:fa:ba:e0:46:9f:28:4e:9d:df:b2:92:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/65c0c10619caaf5dfabae0469f284e9ddfb292fb/; sid:903202349; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"86:af:39:2e:9b:42:ec:50:e2:87:f6:42:9e:f7:48:4c:48:bb:bd:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86af392e9b42ec50e287f6429ef7484c48bbbd95/; sid:903202350; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"33:d6:73:5d:d1:05:c2:d0:d9:00:df:60:3c:16:bb:69:a3:9b:6f:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33d6735dd105c2d0d900df603c16bb69a39b6f5a/; sid:903202351; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d0:bf:5d:40:33:79:d6:b9:50:8c:7f:0f:84:dd:3a:58:ed:6a:bc:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d0bf5d403379d6b9508c7f0f84dd3a58ed6abc53/; sid:903202352; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"63:b9:85:50:d1:cd:85:24:9c:85:6d:04:b2:eb:27:ec:8a:81:b6:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/63b98550d1cd85249c856d04b2eb27ec8a81b6c9/; sid:903202353; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"47:bb:5d:ec:74:45:47:f6:2c:c6:78:b0:ac:89:73:3c:de:51:40:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/47bb5dec744547f62cc678b0ac89733cde514039/; sid:903202354; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"66:61:ba:a6:0d:1a:12:48:be:57:6b:0c:f4:03:5d:f7:72:24:38:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6661baa60d1a1248be576b0cf4035df772243860/; sid:903202355; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"07:72:c4:c6:a3:b4:89:71:4e:d5:17:5a:93:05:bb:7c:c0:86:fb:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0772c4c6a3b489714ed5175a9305bb7cc086fb17/; sid:903202356; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d4:2b:50:12:18:0b:45:54:2b:4c:80:d9:bf:11:5c:d1:ce:c9:9c:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d42b5012180b45542b4c80d9bf115cd1cec99c67/; sid:903202357; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedId C&C)"; tls_cert_fingerprint; content:"aa:38:75:b3:f9:cb:de:32:f2:e1:a5:9c:72:f4:48:1b:d2:a6:a1:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa3875b3f9cbde32f2e1a59c72f4481bd2a6a180/; sid:903202358; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedId C&C)"; tls_cert_fingerprint; content:"77:f0:b3:ef:2a:93:9f:80:1d:c7:e7:61:e0:72:e7:1b:34:13:b1:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77f0b3ef2a939f801dc7e761e072e71b3413b1c1/; sid:903202359; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"5e:82:63:19:ab:ea:f2:0f:0d:90:e9:75:5d:5a:c4:a6:2e:64:93:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e826319abeaf20f0d90e9755d5ac4a62e64931a/; sid:903202360; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"46:aa:93:0d:14:4e:a3:27:ee:d4:c3:3c:44:02:23:3d:52:0c:4f:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46aa930d144ea327eed4c33c4402233d520c4f8b/; sid:903202361; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"fb:d2:d6:bf:48:f2:f5:14:51:ce:b4:69:24:d2:e5:13:76:7e:82:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fbd2d6bf48f2f51451ceb46924d2e513767e8215/; sid:903202362; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"4a:d2:77:c5:b7:fd:e7:cc:ab:01:4a:65:59:b7:b1:cf:ee:c0:21:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ad277c5b7fde7ccab014a6559b7b1cfeec0218f/; sid:903202363; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"c4:7a:93:41:57:2d:05:9d:64:27:d2:4d:f9:65:26:7a:01:2b:d9:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c47a9341572d059d6427d24df965267a012bd9b7/; sid:903202364; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"f9:67:1b:15:d5:b4:21:72:93:46:95:b6:14:9a:6f:1c:6b:04:85:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f9671b15d5b42172934695b6149a6f1c6b0485bc/; sid:903202365; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"18:59:ed:5a:a3:f7:22:08:90:cc:94:e8:3d:19:bb:3d:14:60:59:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1859ed5aa3f7220890cc94e83d19bb3d146059ae/; sid:903202366; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"24:20:0d:6b:e5:dc:2b:91:cd:a6:e2:fe:cb:bd:ed:bb:d5:1b:8f:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24200d6be5dc2b91cda6e2fecbbdedbbd51b8f9c/; sid:903202367; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"55:44:35:b1:c4:ab:1f:24:1a:08:a7:a0:8a:18:8a:05:d3:7f:5a:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/554435b1c4ab1f241a08a7a08a188a05d37f5a74/; sid:903202368; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"27:a5:ba:d4:21:fb:64:b9:06:ba:07:9b:ad:dd:0e:5c:6e:b7:93:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27a5bad421fb64b906ba079baddd0e5c6eb7936f/; sid:903202369; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"03:84:d2:35:e6:a7:36:d1:cb:56:7a:ea:36:0f:fd:dc:52:78:69:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0384d235e6a736d1cb567aea360ffddc5278698b/; sid:903202370; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Trickbot C&C)"; tls_cert_fingerprint; content:"29:64:69:69:f6:8f:41:6d:b8:ae:8c:a4:13:d4:d2:90:0a:e5:e8:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/29646969f68f416db8ae8ca413d4d2900ae5e814/; sid:903202371; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"6f:b3:f5:e9:05:9a:30:d7:a6:ba:44:64:a3:7d:b3:9b:ba:69:e7:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6fb3f5e9059a30d7a6ba4464a37db39bba69e716/; sid:903202372; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Trickbot C&C)"; tls_cert_fingerprint; content:"c8:4c:e8:c4:4b:b6:59:ed:a3:11:4a:0c:e7:b5:f5:4c:7d:86:8c:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c84ce8c44bb659eda3114a0ce7b5f54c7d868cff/; sid:903202373; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"49:02:c7:e0:f2:7f:35:a0:bd:cf:1d:c3:4c:db:d0:dd:90:c4:04:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4902c7e0f27f35a0bdcf1dc34cdbd0dd90c404f9/; sid:903202374; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"51:fa:6c:81:07:cd:e5:59:76:a0:35:99:2e:49:0e:6f:10:0a:1c:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/51fa6c8107cde55976a035992e490e6f100a1ca1/; sid:903202375; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"d6:1b:eb:58:b1:66:2e:64:99:b6:2a:0d:f3:93:95:5b:9f:e4:6f:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d61beb58b1662e6499b62a0df393955b9fe46ffb/; sid:903202376; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"e5:2c:7f:68:ec:01:54:34:f4:21:cc:0b:4e:40:ec:93:98:16:54:12"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e52c7f68ec015434f421cc0b4e40ec9398165412/; sid:903202377; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"aa:67:d3:da:a2:2f:c2:55:6b:1e:81:77:fb:ac:bb:b2:4f:66:85:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aa67d3daa22fc2556b1e8177fbacbbb24f668577/; sid:903202378; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"6c:94:e4:fd:43:e4:fc:66:1b:f2:b2:f6:3e:1c:61:40:22:6c:e3:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6c94e4fd43e4fc661bf2b2f63e1c6140226ce37a/; sid:903202379; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"8c:8b:00:25:bb:8a:ca:f1:ed:25:b7:df:b2:f8:22:2d:61:53:b4:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c8b0025bb8acaf1ed25b7dfb2f8222d6153b4d8/; sid:903202380; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"90:8a:df:d0:55:32:c9:fa:42:0e:1e:0f:4f:39:bb:6a:69:b5:29:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/908adfd05532c9fa420e1e0f4f39bb6a69b529ec/; sid:903202381; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"38:37:e4:30:19:24:fd:86:7b:24:1b:02:d1:27:3f:31:48:77:3b:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3837e4301924fd867b241b02d1273f3148773b83/; sid:903202382; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"78:fe:7c:56:1c:43:52:bb:9c:16:1c:12:a0:29:38:b1:c4:2e:70:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/78fe7c561c4352bb9c161c12a02938b1c42e70cc/; sid:903202383; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"20:ff:ea:17:d3:4c:83:2f:7e:77:3a:6a:03:7c:fc:59:00:21:1a:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20ffea17d34c832f7e773a6a037cfc5900211a2a/; sid:903202384; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Neutrino C&C)"; tls_cert_fingerprint; content:"e1:a5:8a:14:6e:22:9c:c3:0d:47:75:9a:18:d6:da:6b:e3:b8:b7:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1a58a146e229cc30d47759a18d6da6be3b8b70c/; sid:903202385; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (JBifrost C&C)"; tls_cert_fingerprint; content:"bb:07:bd:6f:83:9f:23:6b:8e:dd:49:5e:1a:36:1f:3f:5f:70:2e:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb07bd6f839f236b8edd495e1a361f3f5f702e71/; sid:903202386; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"e0:1b:1d:77:1b:ac:35:16:7c:79:e1:38:91:25:54:a1:60:57:7f:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e01b1d771bac35167c79e138912554a160577f3f/; sid:903202387; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"64:8a:ad:16:9c:99:e9:97:7e:f9:5b:f2:20:10:10:f8:88:80:82:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/648aad169c99e9977ef95bf2201010f888808222/; sid:903202388; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"91:b5:68:ea:95:2c:bf:4a:d6:55:cc:32:15:90:fc:65:cd:ff:9d:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91b568ea952cbf4ad655cc321590fc65cdff9de6/; sid:903202389; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"03:2f:69:7e:5a:17:20:f5:59:97:29:09:ee:cc:1e:7a:1b:ff:67:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/032f697e5a1720f559972909eecc1e7a1bff67be/; sid:903202390; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"50:ef:77:4f:2d:86:65:9b:55:e2:41:1f:37:90:19:9c:e3:fa:3c:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/50ef774f2d86659b55e2411f3790199ce3fa3c5e/; sid:903202391; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"4d:8e:93:19:ba:4b:8d:20:5d:c7:c0:8d:28:0e:f0:0f:46:08:98:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d8e9319ba4b8d205dc7c08d280ef00f460898cf/; sid:903202392; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"24:eb:69:f3:d1:b9:4e:49:6b:15:19:54:33:64:0e:d6:99:1b:c0:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24eb69f3d1b94e496b15195433640ed6991bc05a/; sid:903202393; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"dc:45:c4:5a:c1:bd:2c:fd:21:63:ec:61:da:70:00:59:9c:d4:5a:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc45c45ac1bd2cfd2163ec61da7000599cd45aaf/; sid:903202394; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"cd:a6:eb:fe:ea:00:3d:d9:0d:79:ab:6b:34:1e:ed:25:69:43:9c:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cda6ebfeea003dd90d79ab6b341eed2569439c2d/; sid:903202395; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (JBifrost C&C)"; tls_cert_fingerprint; content:"bb:d4:38:0b:ab:66:8d:9a:7f:92:59:b4:4f:fc:5c:93:b9:91:e9:9e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bbd4380bab668d9a7f9259b44ffc5c93b991e99e/; sid:903202396; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"33:60:d8:59:0e:75:19:d9:b0:e1:ef:17:89:09:0b:9d:67:df:33:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3360d8590e7519d9b0e1ef1789090b9d67df3344/; sid:903202397; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"df:ca:93:b2:4b:40:8e:a6:ea:5f:93:7f:c3:1a:60:2a:66:b7:22:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfca93b24b408ea6ea5f937fc31a602a66b722d1/; sid:903202398; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"81:b6:20:37:f9:d5:3a:ee:b0:6a:9b:39:41:1c:a9:a3:0e:8c:62:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/81b62037f9d53aeeb06a9b39411ca9a30e8c6216/; sid:903202399; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"8d:fc:45:5a:31:9f:2a:f4:ed:17:f3:7e:19:e7:cc:f0:05:34:11:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8dfc455a319f2af4ed17f37e19e7ccf0053411d9/; sid:903202400; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"7c:58:c7:ec:9e:cd:0e:5e:6f:02:2b:d7:2a:f4:15:aa:4f:52:ad:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c58c7ec9ecd0e5e6f022bd72af415aa4f52ad10/; sid:903202401; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"06:cb:f1:2a:81:aa:63:04:57:d2:68:36:c6:2a:c0:bb:aa:77:f3:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06cbf12a81aa630457d26836c62ac0bbaa77f3f9/; sid:903202402; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"27:3b:0f:ab:7e:fd:e3:65:25:63:2e:74:98:9b:3e:a5:38:3f:3e:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/273b0fab7efde36525632e74989b3ea5383f3e05/; sid:903202403; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e9:8b:d7:5c:f7:e9:92:84:7d:d1:64:39:7a:62:df:aa:c0:36:d1:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e98bd75cf7e992847dd164397a62dfaac036d14b/; sid:903202404; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"1f:1d:4a:59:b9:d7:20:d6:9d:df:cd:65:b9:0d:51:e5:23:66:a2:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f1d4a59b9d720d69ddfcd65b90d51e52366a2e3/; sid:903202405; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1e:85:b5:59:a3:c5:2d:45:c4:b6:82:82:d1:0b:21:bb:a3:a8:78:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e85b559a3c52d45c4b68282d10b21bba3a878a5/; sid:903202406; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7b:21:cf:dd:cf:88:de:4c:38:32:a0:7d:0a:0f:22:b2:32:ce:25:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b21cfddcf88de4c3832a07d0a0f22b232ce251b/; sid:903202407; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"fc:ab:10:cf:56:45:9c:8c:25:7f:54:39:d0:11:51:45:9d:e7:93:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fcab10cf56459c8c257f5439d01151459de79363/; sid:903202408; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a2:db:2b:8e:32:11:10:60:8d:a4:d7:fb:ce:45:98:8f:f8:ea:a0:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a2db2b8e321110608da4d7fbce45988ff8eaa048/; sid:903202409; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"0e:d2:66:20:06:05:c8:61:f8:ee:04:23:9e:92:12:87:d0:b2:0a:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ed266200605c861f8ee04239e921287d0b20a21/; sid:903202410; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"4a:05:57:91:3a:4b:6e:5a:8e:69:74:5b:41:14:9e:5b:16:f8:96:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a0557913a4b6e5a8e69745b41149e5b16f8964f/; sid:903202411; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"26:00:35:eb:97:20:d8:79:95:1b:e4:10:59:15:df:63:29:c9:c0:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/260035eb9720d879951be4105915df6329c9c0e3/; sid:903202412; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"a0:79:a1:69:44:67:fe:94:e6:ee:e9:5b:0e:ad:9b:65:2b:69:f7:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a079a1694467fe94e6eee95b0ead9b652b69f774/; sid:903202413; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"e0:d9:03:bb:dd:c6:42:e5:f7:82:0b:22:d8:6e:ae:9e:15:a7:b2:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e0d903bbddc642e5f7820b22d86eae9e15a7b2f8/; sid:903202414; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Quakbot C&C)"; tls_cert_fingerprint; content:"6c:fe:bb:47:09:8a:bd:1b:3e:1e:cd:cc:14:e2:94:a3:36:84:88:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cfebb47098abd1b3e1ecdcc14e294a3368488fa/; sid:903202415; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"e9:76:1a:a8:44:2c:5a:77:d2:d3:67:cb:6b:4c:5b:0d:b9:7c:da:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9761aa8442c5a77d2d367cb6b4c5b0db97cda64/; sid:903202416; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"87:9c:44:5c:7a:5b:31:9e:e0:4e:3a:1d:1e:34:24:f4:6b:15:06:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/879c445c7a5b319ee04e3a1d1e3424f46b15064e/; sid:903202417; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"7b:e5:9f:8f:08:11:aa:bc:b7:3c:9f:1c:7d:f3:b3:e6:6f:96:4c:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7be59f8f0811aabcb73c9f1c7df3b3e66f964ca0/; sid:903202418; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Godzilla C&C)"; tls_cert_fingerprint; content:"91:1b:fb:c7:6d:3c:05:6b:8f:61:ae:ce:04:2f:ef:cc:d2:be:07:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/911bfbc76d3c056b8f61aece042fefccd2be0741/; sid:903202419; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"d3:70:34:3a:1c:20:c3:09:ff:59:86:01:a1:06:ec:9b:38:5c:55:c2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d370343a1c20c309ff598601a106ec9b385c55c2/; sid:903202420; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"90:27:03:c5:69:f3:a5:b5:51:67:00:c8:3d:2a:a1:83:7d:26:92:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/902703c569f3a5b5516700c83d2aa1837d2692d5/; sid:903202421; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"8a:9a:ab:e3:cb:98:60:8e:65:d1:0c:9c:f0:b4:c5:3a:f9:a8:fb:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8a9aabe3cb98608e65d10c9cf0b4c53af9a8fb6f/; sid:903202422; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AgentTesla C&C)"; tls_cert_fingerprint; content:"f6:da:c3:39:e1:6f:90:b8:4d:91:58:8e:7f:58:1f:35:f2:0d:e2:a7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f6dac339e16f90b84d91588e7f581f35f20de2a7/; sid:903202423; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"0e:ca:9e:f8:35:6e:ce:1b:e7:32:d9:f6:fc:01:a8:e5:37:af:26:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0eca9ef8356ece1be732d9f6fc01a8e537af2611/; sid:903202424; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"1e:7a:0c:90:03:f3:32:a7:01:0f:ec:12:7f:79:dc:28:3e:be:c6:5c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e7a0c9003f332a7010fec127f79dc283ebec65c/; sid:903202425; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedId C&C)"; tls_cert_fingerprint; content:"81:6c:8e:ed:c2:63:2d:e8:a8:8b:77:7e:28:f9:1a:4f:3f:7e:89:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/816c8eedc2632de8a88b777e28f91a4f3f7e8936/; sid:903202426; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"01:a4:58:bd:2d:46:b4:38:3b:11:46:9f:1c:8e:4f:33:67:53:ec:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01a458bd2d46b4383b11469f1c8e4f336753ec4d/; sid:903202427; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"56:1a:72:26:7a:de:93:d2:7c:59:ba:c1:7e:08:ea:41:13:21:54:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/561a72267ade93d27c59bac17e08ea411321548b/; sid:903202428; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"41:5d:67:5f:e2:87:39:b2:63:dd:69:d7:b3:c3:88:13:84:df:b3:81"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/415d675fe28739b263dd69d7b3c3881384dfb381/; sid:903202429; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b9:15:72:36:5a:7e:b7:1c:32:4f:67:dc:08:ac:0f:96:b0:a1:0b:f2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b91572365a7eb71c324f67dc08ac0f96b0a10bf2/; sid:903202430; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"27:4e:6b:65:83:4c:29:ac:9c:f7:60:e4:35:d2:74:4e:cb:f2:57:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/274e6b65834c29ac9cf760e435d2744ecbf25736/; sid:903202431; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"32:fd:c0:8f:0e:5b:bd:94:d9:48:72:3f:5b:d1:86:ff:ab:96:38:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32fdc08f0e5bbd94d948723f5bd186ffab9638ee/; sid:903202432; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"11:a3:71:40:0d:c9:e6:e3:1b:f5:10:c0:8f:d2:bf:b4:d2:26:f0:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11a371400dc9e6e31bf510c08fd2bfb4d226f056/; sid:903202433; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"c3:09:eb:88:fe:d4:9b:93:25:54:88:52:79:b9:aa:05:71:9c:cd:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c309eb88fed49b932554885279b9aa05719ccd61/; sid:903202434; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"ef:88:a8:2e:c4:d8:53:ed:f8:49:28:a5:ba:cc:a4:ea:c8:4c:b5:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef88a82ec4d853edf84928a5bacca4eac84cb5dc/; sid:903202435; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f3:36:0e:03:9f:06:9d:0a:5c:4d:b8:e8:48:bd:bf:1a:8b:ff:46:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f3360e039f069d0a5c4db8e848bdbf1a8bff461a/; sid:903202436; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"de:d1:f2:77:d9:be:c1:f6:e6:ba:23:79:4c:5a:5a:80:b3:9a:ee:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ded1f277d9bec1f6e6ba23794c5a5a80b39aeee4/; sid:903202437; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"b6:f8:4c:4c:e2:41:3e:59:d9:d7:a8:95:b9:34:3f:64:81:98:90:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6f84c4ce2413e59d9d7a895b9343f64819890d5/; sid:903202438; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Neutrino C&C)"; tls_cert_fingerprint; content:"67:88:d7:dc:2b:81:8c:98:8e:07:d8:91:13:9b:96:3c:39:61:5d:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6788d7dc2b818c988e07d891139b963c39615d8a/; sid:903202439; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3f:03:cd:3f:d3:66:ad:cd:3c:6c:db:f8:35:ae:72:e2:72:c5:c9:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3f03cd3fd366adcd3c6cdbf835ae72e272c5c904/; sid:903202440; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"cb:66:0b:8e:58:fa:3e:8b:85:f7:a4:75:f3:7f:b3:7a:3e:07:2e:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb660b8e58fa3e8b85f7a475f37fb37a3e072e4f/; sid:903202441; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"34:61:60:fd:d3:6f:63:56:2b:60:e3:ed:39:d1:fd:65:b3:e5:d2:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/346160fdd36f63562b60e3ed39d1fd65b3e5d282/; sid:903202442; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3a:1f:60:e1:65:0f:c9:29:79:c6:22:64:8f:be:e1:5e:ce:6c:7a:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a1f60e1650fc92979c622648fbee15ece6c7a69/; sid:903202443; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"32:17:fa:d9:7e:f7:9c:5f:fd:02:24:62:9b:ef:a8:df:5e:7f:92:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3217fad97ef79c5ffd0224629befa8df5e7f92ff/; sid:903202444; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (RevCodeRAT C&C)"; tls_cert_fingerprint; content:"df:e1:a7:f8:a0:02:88:bd:50:13:61:e4:72:18:7b:9f:71:4b:ea:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dfe1a7f8a00288bd501361e472187b9f714bea21/; sid:903202445; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"e4:04:61:15:78:42:7b:91:9c:fe:99:56:0c:cd:55:f9:b0:af:a4:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e404611578427b919cfe99560ccd55f9b0afa4ad/; sid:903202446; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"59:2b:c7:2a:43:de:df:22:2c:7d:44:35:e0:2d:ad:0d:8a:8a:2a:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/592bc72a43dedf222c7d4435e02dad0d8a8a2a55/; sid:903202447; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Smoke Loader C&C)"; tls_cert_fingerprint; content:"d3:32:98:d1:fe:3d:43:ec:c0:87:c2:88:3f:ba:8a:6c:c1:24:c4:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d33298d1fe3d43ecc087c2883fba8a6cc124c42e/; sid:903202448; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"90:cb:e1:c1:78:89:25:72:f2:42:79:45:c2:80:c8:89:b3:7a:82:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/90cbe1c178892572f2427945c280c889b37a82bd/; sid:903202449; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"9b:97:45:ca:28:5a:39:0d:ed:ed:ca:e5:53:df:50:8b:3b:45:01:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9b9745ca285a390dededcae553df508b3b450127/; sid:903202450; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"05:b2:3a:86:fe:8e:9c:0a:5f:68:ff:7a:72:ee:3c:65:ce:6d:d6:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/05b23a86fe8e9c0a5f68ff7a72ee3c65ce6dd61f/; sid:903202451; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ea:e7:19:ff:45:92:30:73:22:3a:8f:fe:06:5b:b7:33:b2:f0:f6:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eae719ff45923073223a8ffe065bb733b2f0f6b6/; sid:903202452; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"81:7c:e4:c9:b0:36:bc:5f:76:e2:7b:fe:5f:02:fd:dc:b6:bb:8a:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/817ce4c9b036bc5f76e27bfe5f02fddcb6bb8a80/; sid:903202453; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"26:30:75:8f:20:6f:a9:48:92:ff:bd:10:94:0c:86:a8:86:ac:18:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2630758f206fa94892ffbd10940c86a886ac1814/; sid:903202454; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PlugX C&C)"; tls_cert_fingerprint; content:"16:0b:26:68:d6:72:06:c1:a6:ed:b3:b6:04:8d:77:b6:be:2b:ec:c7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/160b2668d67206c1a6edb3b6048d77b6be2becc7/; sid:903202455; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cf:ba:3a:23:0f:38:b1:ce:2c:0f:6c:84:85:4f:b1:f1:db:e7:4d:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfba3a230f38b1ce2c0f6c84854fb1f1dbe74d46/; sid:903202456; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"a1:db:30:fa:02:97:55:10:06:48:c0:05:58:eb:32:74:c4:c9:8b:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a1db30fa029755100648c00558eb3274c4c98b1d/; sid:903202457; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"de:d6:8c:5f:77:07:c1:8a:9c:cc:37:a1:21:27:d0:6a:95:e9:e9:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ded68c5f7707c18a9ccc37a12127d06a95e9e97e/; sid:903202458; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"19:3e:5a:e8:78:e2:a7:1f:4f:cc:60:f4:21:68:bc:63:d1:9d:1f:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/193e5ae878e2a71f4fcc60f42168bc63d19d1fb5/; sid:903202459; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f5:63:9b:20:d1:35:17:44:5e:5d:fb:6c:01:d1:f2:4d:f6:16:b0:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5639b20d13517445e5dfb6c01d1f24df616b034/; sid:903202460; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"98:c9:7e:bc:f9:a1:6f:60:41:36:30:7b:cf:25:1f:9e:00:75:5d:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/98c97ebcf9a16f604136307bcf251f9e00755d99/; sid:903202461; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"46:4b:cd:ed:25:95:72:2c:00:c2:44:70:98:06:b6:4b:95:fd:52:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/464bcded2595722c00c244709806b64b95fd52cc/; sid:903202462; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"de:d0:f2:f4:52:cf:44:8b:64:ac:9e:47:5c:3e:62:1e:dd:7a:7f:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ded0f2f452cf448b64ac9e475c3e621edd7a7f87/; sid:903202463; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"38:83:e2:f7:30:57:40:57:d5:cd:f9:1e:ae:56:2b:9c:56:e5:b5:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3883e2f730574057d5cdf91eae562b9c56e5b50d/; sid:903202464; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2c:34:71:27:a7:33:33:09:51:af:90:bd:39:1d:4c:b2:5c:f6:86:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c347127a733330951af90bd391d4cb25cf68620/; sid:903202465; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5b:66:b1:0a:ec:a3:0b:93:d2:c7:76:c9:2b:3b:cb:02:d6:d3:6a:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b66b10aeca30b93d2c776c92b3bcb02d6d36ae5/; sid:903202466; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7e:55:fb:87:67:15:0f:56:55:cd:0a:b8:53:c4:6c:cd:83:e0:e2:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7e55fb8767150f5655cd0ab853c46ccd83e0e26c/; sid:903202467; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"b1:5b:34:ca:a4:71:58:b1:7b:5d:64:fc:ce:46:21:19:35:5c:db:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b15b34caa47158b17b5d64fcce462119355cdb16/; sid:903202468; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5c:95:5d:b9:6e:be:42:de:ea:35:db:89:92:ca:f9:43:e2:a3:3d:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c955db96ebe42deea35db8992caf943e2a33db1/; sid:903202469; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ac:d5:3a:9a:fe:1e:cc:f4:13:14:05:19:93:5d:ab:f7:52:b4:43:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acd53a9afe1eccf413140519935dabf752b4434b/; sid:903202470; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"ac:2d:7d:26:06:2d:68:bc:48:87:0c:fe:1a:fb:c1:dd:42:a2:43:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac2d7d26062d68bc48870cfe1afbc1dd42a24341/; sid:903202471; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedId C&C)"; tls_cert_fingerprint; content:"d6:41:2d:b5:0d:f6:62:b5:af:43:a2:a2:0d:fe:58:e0:0c:ab:09:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d6412db50df662b5af43a2a20dfe58e00cab0996/; sid:903202472; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"a2:39:ed:1a:80:53:2b:74:1f:b9:e0:94:cd:51:b0:5c:ea:9b:6f:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a239ed1a80532b741fb9e094cd51b05cea9b6ffa/; sid:903202473; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a9:03:28:dc:8d:f0:80:df:60:1e:67:3f:30:59:a7:03:c0:c4:06:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a90328dc8df080df601e673f3059a703c0c40684/; sid:903202474; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d0:5e:2e:91:f5:75:61:10:6c:b0:83:83:e6:99:6e:a7:2a:d9:a0:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d05e2e91f57561106cb08383e6996ea72ad9a035/; sid:903202475; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"f5:79:9d:92:0d:c1:e4:34:b0:87:33:d3:79:d8:b2:85:9a:00:ca:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5799d920dc1e434b08733d379d8b2859a00ca24/; sid:903202476; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"f7:9b:be:93:2d:59:f4:c5:03:a5:33:8d:bc:3a:24:de:a7:c2:f6:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f79bbe932d59f4c503a5338dbc3a24dea7c2f6ea/; sid:903202477; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CoinMiner C&C)"; tls_cert_fingerprint; content:"84:ec:9d:5d:57:9c:aa:09:83:fe:30:91:7e:09:aa:35:5a:f9:fe:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84ec9d5d579caa0983fe30917e09aa355af9fe3c/; sid:903202478; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"82:80:52:63:69:cf:bb:46:ed:5d:87:99:f6:51:b0:e6:9a:73:09:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8280526369cfbb46ed5d8799f651b0e69a73099f/; sid:903202479; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"f0:f6:30:28:24:cd:73:b2:c8:b6:dd:8e:0c:d3:25:a3:ef:08:24:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0f6302824cd73b2c8b6dd8e0cd325a3ef082409/; sid:903202480; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"42:75:c1:28:8b:76:98:3c:d6:ec:48:b4:79:08:99:2f:13:41:63:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4275c1288b76983cd6ec48b47908992f13416354/; sid:903202481; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"10:b9:1a:45:3a:e6:c3:dc:71:df:8d:44:85:fa:48:92:99:b9:85:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10b91a453ae6c3dc71df8d4485fa489299b9859f/; sid:903202482; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"f3:50:26:cf:90:e2:b7:6b:8b:74:d9:45:bf:19:1f:cc:02:c3:bd:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f35026cf90e2b76b8b74d945bf191fcc02c3bdc5/; sid:903202483; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"fc:72:a8:a7:b4:67:b2:76:32:4d:92:31:c9:e4:5f:c3:10:0c:0c:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc72a8a7b467b276324d9231c9e45fc3100c0cdc/; sid:903202484; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8c:c8:47:8b:20:f1:70:1f:8d:58:41:05:59:da:00:57:78:2f:22:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8cc8478b20f1701f8d58410559da0057782f2258/; sid:903202485; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"45:5d:8e:38:4d:21:4c:17:d3:45:22:41:3a:98:dc:00:23:52:b7:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/455d8e384d214c17d34522413a98dc002352b78e/; sid:903202486; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"60:11:78:22:72:80:3e:d6:c3:0a:3e:91:56:c8:a7:18:c9:9c:39:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6011782272803ed6c30a3e9156c8a718c99c3974/; sid:903202487; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4e:f2:cc:e6:ed:ae:cb:12:65:22:59:cd:f9:81:5b:65:6d:1d:a2:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ef2cce6edaecb12652259cdf9815b656d1da27a/; sid:903202488; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d9:37:f9:49:68:e0:cd:d1:b7:df:10:99:e6:1f:86:75:24:a1:ad:81"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d937f94968e0cdd1b7df1099e61f867524a1ad81/; sid:903202489; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a5:85:fb:98:c1:71:bd:5e:2c:91:fb:b5:a3:23:64:df:6e:13:6f:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a585fb98c171bd5e2c91fbb5a32364df6e136f1f/; sid:903202490; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5b:42:11:d7:1b:ea:47:b6:5f:dc:d5:26:b1:7a:6e:f3:2a:f6:5c:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b4211d71bea47b65fdcd526b17a6ef32af65c5d/; sid:903202491; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"60:a3:76:7e:f8:b6:80:c7:86:71:95:63:83:69:b0:51:ce:b5:45:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60a3767ef8b680c7867195638369b051ceb545d7/; sid:903202492; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ba:66:b8:10:3d:8f:a5:c3:0e:b6:46:49:bd:24:cf:cb:08:93:bf:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba66b8103d8fa5c30eb64649bd24cfcb0893bf37/; sid:903202493; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"34:ad:00:df:ba:a6:1d:0f:03:7a:8c:32:d9:2d:f7:7e:d6:38:38:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34ad00dfbaa61d0f037a8c32d92df77ed63838ec/; sid:903202494; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ec:ed:fc:67:4b:72:45:69:c0:1c:4d:a4:53:6f:d7:f8:ed:60:65:0f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecedfc674b724569c01c4da4536fd7f8ed60650f/; sid:903202495; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"9b:c0:71:9a:6b:45:02:7c:6b:18:c3:c6:a9:22:84:c6:36:51:0a:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9bc0719a6b45027c6b18c3c6a92284c636510a65/; sid:903202496; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PandaZeuS C&C)"; tls_cert_fingerprint; content:"e8:a1:74:bd:78:96:e9:7d:ca:77:ec:a0:e5:eb:1c:ab:6d:68:08:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8a174bd7896e97dca77eca0e5eb1cab6d680894/; sid:903202497; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"14:f2:a0:8a:c3:07:c0:02:5f:39:47:c4:5e:e1:28:42:28:f9:78:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/14f2a08ac307c0025f3947c45ee1284228f97842/; sid:903202498; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8b:2f:81:38:1d:66:32:72:76:4b:f9:29:aa:d9:b8:00:b2:56:1a:22"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b2f81381d663272764bf929aad9b800b2561a22/; sid:903202499; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"3e:26:b4:46:41:70:a1:59:49:7c:79:98:16:85:24:dd:e5:65:a2:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e26b4464170a159497c7998168524dde565a2f1/; sid:903202500; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e9:5a:33:88:c2:a7:96:fb:e0:5e:c1:1e:1f:f5:bc:b4:b6:72:60:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e95a3388c2a796fbe05ec11e1ff5bcb4b67260f5/; sid:903202501; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"67:46:07:2c:2f:7c:05:77:e4:05:56:2e:3e:21:72:c9:d3:00:37:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6746072c2f7c0577e405562e3e2172c9d300370d/; sid:903202502; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"01:b8:a3:89:9b:ae:90:fb:4c:4e:05:96:d5:48:00:34:07:d6:5b:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01b8a3899bae90fb4c4e0596d548003407d65b53/; sid:903202503; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"66:f6:92:63:1b:d7:c5:82:5c:69:fe:94:1a:68:47:b9:96:8f:d7:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/66f692631bd7c5825c69fe941a6847b9968fd72f/; sid:903202504; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5d:8e:26:00:0d:2c:35:f4:07:e9:aa:be:58:aa:00:c6:7f:c3:0b:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d8e26000d2c35f407e9aabe58aa00c67fc30b8b/; sid:903202505; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5d:6e:fa:1e:8d:d9:d2:d9:67:8a:16:b9:cb:c9:81:47:3b:11:96:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d6efa1e8dd9d2d9678a16b9cbc981473b1196ed/; sid:903202506; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"5b:38:cd:65:8f:78:a0:20:10:ba:1e:e6:ef:d5:2b:97:80:92:09:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b38cd658f78a02010ba1ee6efd52b97809209c3/; sid:903202507; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"64:c8:42:14:79:42:b6:e7:a7:fb:09:d9:02:76:66:96:ad:07:de:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/64c842147942b6e7a7fb09d902766696ad07de89/; sid:903202508; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"b7:81:c5:2d:5b:3a:56:6d:d0:65:91:81:ff:3d:14:84:8c:04:45:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b781c52d5b3a566dd0659181ff3d14848c0445be/; sid:903202509; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e3:43:fe:e3:ad:bf:70:e5:34:37:07:d2:9b:f3:45:56:bd:0d:3f:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e343fee3adbf70e5343707d29bf34556bd0d3f27/; sid:903202510; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c5:26:33:61:ea:09:64:98:cf:9d:c6:3b:8a:96:7c:9e:26:92:47:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c5263361ea096498cf9dc63b8a967c9e2692470b/; sid:903202511; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"73:c3:4b:94:98:93:4f:5f:78:1a:46:87:ba:c2:90:17:f6:c9:5f:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/73c34b9498934f5f781a4687bac29017f6c95fac/; sid:903202512; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"58:f8:fa:bc:ac:cf:b7:7c:a5:48:15:d1:c8:13:02:3f:c8:70:17:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/58f8fabcaccfb77ca54815d1c813023fc870172d/; sid:903202513; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b9:57:c8:02:5a:ac:4e:da:cc:8f:3a:9b:3b:cd:9b:2c:30:97:78:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b957c8025aac4edacc8f3a9b3bcd9b2c30977805/; sid:903202514; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"90:7c:73:ee:89:0f:4f:b7:89:b2:0d:17:e4:35:2d:eb:f1:b0:f8:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/907c73ee890f4fb789b20d17e4352debf1b0f8f9/; sid:903202515; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c1:7c:2b:b7:38:62:7e:81:9e:93:39:f5:7e:8b:98:96:7e:09:f3:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c17c2bb738627e819e9339f57e8b98967e09f3cb/; sid:903202516; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f4:eb:3c:7d:e0:3b:77:76:8b:a3:0a:b3:54:4c:87:90:e5:46:51:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f4eb3c7de03b77768ba30ab3544c8790e546514f/; sid:903202517; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"38:8d:99:59:2d:32:b7:60:7e:5c:cb:ff:f6:08:78:d1:4e:c2:16:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/388d99592d32b7607e5ccbfff60878d14ec2163f/; sid:903202518; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"98:68:fd:c9:a9:dd:14:97:ce:4f:ad:ad:7c:8d:44:14:07:e0:af:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9868fdc9a9dd1497ce4fadad7c8d441407e0afee/; sid:903202519; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"eb:65:5b:ef:01:a9:70:ec:00:ff:5b:3b:bf:ae:ae:96:b8:02:7a:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb655bef01a970ec00ff5b3bbfaeae96b8027a06/; sid:903202520; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"9c:0a:86:3f:8f:c3:ed:a4:57:18:ba:00:5e:11:ad:68:91:b7:56:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c0a863f8fc3eda45718ba005e11ad6891b75631/; sid:903202521; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"05:94:6f:5e:76:64:d0:84:30:55:00:3b:e6:aa:63:5d:6c:69:24:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/05946f5e7664d0843055003be6aa635d6c69243b/; sid:903202522; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a5:58:47:bc:3a:b9:21:01:a7:05:0d:07:e9:d0:42:a2:27:2a:fd:77"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a55847bc3ab92101a7050d07e9d042a2272afd77/; sid:903202523; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"60:4c:15:52:88:60:f0:f9:de:f6:a5:ac:e4:19:10:5f:13:3a:88:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/604c15528860f0f9def6a5ace419105f133a886c/; sid:903202524; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b0:5d:8b:ff:3c:d8:60:c0:05:fe:98:da:c3:b3:8e:c1:4f:46:bd:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b05d8bff3cd860c005fe98dac3b38ec14f46bd7b/; sid:903202525; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"fb:26:15:62:4b:31:ec:99:8f:5a:70:6d:e5:f8:73:90:57:be:eb:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb2615624b31ec998f5a706de5f8739057beebc9/; sid:903202526; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1e:91:b3:70:24:81:31:94:61:27:bc:a8:dc:21:32:2a:d1:00:06:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1e91b370248131946127bca8dc21322ad1000653/; sid:903202527; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"d2:24:e5:be:bb:cb:3a:b7:20:6d:70:30:e1:51:58:ac:1e:f8:8f:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d224e5bebbcb3ab7206d7030e15158ac1ef88f7c/; sid:903202528; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b6:2a:f5:2f:f5:63:89:ee:60:d2:30:6a:ab:f4:ff:d1:f0:58:d2:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b62af52ff56389ee60d2306aabf4ffd1f058d2dc/; sid:903202529; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"26:80:88:84:50:c9:f7:9c:f7:d3:c6:ea:9f:2e:4a:f9:8f:96:cf:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2680888450c9f79cf7d3c6ea9f2e4af98f96cfef/; sid:903202530; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ab:4e:c2:61:cf:ea:45:9e:21:70:97:db:b9:fc:f6:19:63:ff:89:0e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab4ec261cfea459e217097dbb9fcf61963ff890e/; sid:903202531; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ad:b1:c8:6b:00:ed:2a:d3:8e:00:42:8d:8f:34:8d:53:d5:f8:59:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/adb1c86b00ed2ad38e00428d8f348d53d5f85967/; sid:903202532; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"77:45:7b:9d:c2:45:ec:9c:ff:b2:e3:38:83:b3:bf:df:37:3d:fe:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/77457b9dc245ec9cffb2e33883b3bfdf373dfeca/; sid:903202533; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex malware distribution)"; tls_cert_fingerprint; content:"3b:db:2f:4b:21:9c:b0:8d:bf:ba:e4:dc:08:81:a1:62:37:e7:ad:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3bdb2f4b219cb08dbfbae4dc0881a16237e7ad68/; sid:903202534; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"0f:3f:71:70:20:b1:32:bd:e9:6c:9d:00:17:3a:7a:53:dd:68:ea:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f3f717020b132bde96c9d00173a7a53dd68ead9/; sid:903202535; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"ec:e2:71:9a:4d:35:7e:7e:a7:00:24:f6:51:af:8d:9c:ce:43:25:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ece2719a4d357e7ea70024f651af8d9cce43256b/; sid:903202536; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"76:69:10:3e:a0:a2:e9:00:17:9e:52:20:a1:3b:f3:41:54:38:b6:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7669103ea0a2e900179e5220a13bf3415438b665/; sid:903202537; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"27:1e:87:98:5f:3d:6b:e3:9e:94:a1:25:e1:76:6d:99:6f:3f:1e:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/271e87985f3d6be39e94a125e1766d996f3f1e6c/; sid:903202538; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ff:5d:86:92:50:a5:c8:c0:8e:dc:fe:83:25:c1:a1:0e:28:3e:cb:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff5d869250a5c8c08edcfe8325c1a10e283ecb1f/; sid:903202539; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c8:92:27:62:73:a6:2a:cb:df:f9:f6:ce:68:85:d0:9f:4f:95:c9:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c892276273a62acbdff9f6ce6885d09f4f95c944/; sid:903202540; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d3:dd:70:6d:4d:c2:5e:e6:3a:55:02:b0:7f:d2:06:32:14:a9:46:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3dd706d4dc25ee63a5502b07fd2063214a94651/; sid:903202541; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"21:bc:5c:b3:66:1d:43:36:66:b0:b9:68:44:30:61:56:1b:82:18:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/21bc5cb3661d433666b0b968443061561b8218f8/; sid:903202542; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"41:12:fd:7e:6a:5f:6d:49:90:ef:99:d3:10:c1:e2:03:15:23:be:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4112fd7e6a5f6d4990ef99d310c1e2031523be38/; sid:903202543; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7b:97:6d:83:a1:8a:cd:d0:a0:bc:6d:74:c7:c6:1e:95:63:aa:4f:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b976d83a18acdd0a0bc6d74c7c61e9563aa4f48/; sid:903202544; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"88:88:a7:cd:6c:9a:e6:56:a4:af:d2:1a:5e:37:8f:6a:0d:d4:69:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8888a7cd6c9ae656a4afd21a5e378f6a0dd469e6/; sid:903202545; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"0f:54:d8:f7:eb:72:3b:69:0d:8d:5b:61:61:01:36:fa:68:40:d2:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0f54d8f7eb723b690d8d5b61610136fa6840d2e1/; sid:903202546; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"cb:fb:79:de:f9:bb:d7:6d:3e:06:eb:11:c1:33:d7:a7:4f:93:b7:07"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cbfb79def9bbd76d3e06eb11c133d7a74f93b707/; sid:903202547; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"54:e1:3b:d7:35:01:76:81:7c:2a:0c:58:99:67:ea:7e:00:19:93:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54e13bd7350176817c2a0c589967ea7e00199357/; sid:903202548; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3e:d3:f4:04:47:b4:17:04:ea:25:41:b2:bb:86:84:8c:33:2b:14:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ed3f40447b41704ea2541b2bb86848c332b14c3/; sid:903202549; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"4e:06:3c:d8:a4:03:64:1d:03:79:29:a5:2e:ba:fa:47:d4:7f:8a:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e063cd8a403641d037929a52ebafa47d47f8afa/; sid:903202550; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a2:17:93:16:1e:08:cc:ed:10:5d:bd:0d:5f:63:cf:22:af:13:22:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a21793161e08cced105dbd0d5f63cf22af13224d/; sid:903202551; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"9e:1c:95:c3:70:b0:d1:e1:0c:47:b1:ae:29:22:b7:e8:2f:e4:b0:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9e1c95c370b0d1e10c47b1ae2922b7e82fe4b0f1/; sid:903202552; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"d2:9d:61:cb:52:57:a8:51:da:02:60:8f:45:30:a9:44:ad:ae:e0:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d29d61cb5257a851da02608f4530a944adaee071/; sid:903202553; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e9:1c:16:05:80:18:94:94:6c:0e:e4:06:51:cf:98:48:84:f5:4c:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e91c1605801894946c0ee40651cf984884f54cb9/; sid:903202554; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f1:4f:1a:83:ed:dc:df:14:66:8e:6f:09:42:6f:c2:72:d7:1d:c3:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f14f1a83eddcdf14668e6f09426fc272d71dc371/; sid:903202555; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"6e:bc:65:b3:26:99:9b:45:34:3b:63:6b:7d:22:ef:c0:85:f7:c6:74"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ebc65b326999b45343b636b7d22efc085f7c674/; sid:903202556; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"d1:01:78:9b:a0:68:fc:74:5a:db:51:a3:20:ef:01:63:23:6a:a9:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d101789ba068fc745adb51a320ef0163236aa9f7/; sid:903202557; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"15:e1:bd:e4:90:62:db:f2:d8:e2:1f:01:cb:f4:23:1e:af:f8:b2:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15e1bde49062dbf2d8e21f01cbf4231eaff8b2dd/; sid:903202558; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"85:64:cd:4e:73:70:2c:53:4b:d9:d6:9f:13:32:82:64:44:9e:93:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8564cd4e73702c534bd9d69f13328264449e9380/; sid:903202559; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"4a:51:71:cf:80:f8:d9:95:0b:e3:2f:e3:dd:22:0a:92:a3:11:6f:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a5171cf80f8d9950be32fe3dd220a92a3116fa6/; sid:903202560; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"f2:9e:95:3d:d2:78:98:18:77:ae:7b:53:68:ca:a5:37:85:6a:e9:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f29e953dd278981877ae7b5368caa537856ae9f4/; sid:903202561; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"bd:b7:4e:c2:21:c2:c4:50:52:d1:c7:b1:3a:b9:21:85:7b:29:c4:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bdb74ec221c2c45052d1c7b13ab921857b29c4e6/; sid:903202562; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"2c:f8:0f:a7:8c:7a:b8:03:1d:80:1a:8a:f3:29:c4:8c:99:bf:79:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2cf80fa78c7ab8031d801a8af329c48c99bf79f5/; sid:903202563; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"58:60:c1:fb:dc:9c:99:14:c3:98:63:90:44:0f:24:45:90:97:d3:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5860c1fbdc9c9914c3986390440f24459097d33e/; sid:903202564; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"19:fc:51:f0:a4:18:1e:61:0b:61:87:a5:22:a1:5a:ef:7b:56:ed:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19fc51f0a4181e610b6187a522a15aef7b56ed33/; sid:903202565; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4f:f3:6a:9b:0d:db:2a:ea:da:45:e3:a9:38:47:a3:38:52:88:68:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ff36a9b0ddb2aeada45e3a93847a33852886853/; sid:903202566; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ec:d6:ec:44:a3:0b:04:7d:6e:75:40:12:02:b2:20:a7:64:8b:d4:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecd6ec44a30b047d6e75401202b220a7648bd4cc/; sid:903202567; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Meterpreter C&C)"; tls_cert_fingerprint; content:"04:3d:1a:11:a0:6d:7a:60:65:01:65:9a:34:ca:e9:41:50:84:6e:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/043d1a11a06d7a606501659a34cae94150846e9d/; sid:903202568; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"08:c1:91:86:c8:80:6b:0b:81:6b:ef:14:da:8e:b1:67:47:b5:5b:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08c19186c8806b0b816bef14da8eb16747b55b5a/; sid:903202569; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"fc:80:21:84:e7:d0:85:d0:36:50:a9:d6:a8:80:b2:c8:96:66:d0:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc802184e7d085d03650a9d6a880b2c89666d017/; sid:903202570; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"03:1d:54:84:27:25:0e:43:9a:67:b7:93:04:3d:f2:d5:a2:19:16:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/031d548427250e439a67b793043df2d5a21916ac/; sid:903202571; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"28:21:83:e6:4c:46:48:41:ed:c4:24:16:3e:36:45:6a:48:92:13:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/282183e64c464841edc424163e36456a489213fe/; sid:903202572; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"89:ff:12:a2:15:18:7f:e8:e9:00:5c:0c:e2:fe:0b:a4:14:16:3d:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89ff12a215187fe8e9005c0ce2fe0ba414163d45/; sid:903202573; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"c1:d7:91:2b:6a:17:6b:02:a9:c7:de:1e:94:a5:ea:36:79:4e:7b:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1d7912b6a176b02a9c7de1e94a5ea36794e7b20/; sid:903202574; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e8:f3:af:d3:a0:34:36:21:8f:ff:3d:c0:a0:d7:a6:71:c8:23:13:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8f3afd3a03436218fff3dc0a0d7a671c8231353/; sid:903202575; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"61:86:ae:b9:1b:ad:fe:e6:1d:97:0d:59:64:69:70:7d:fa:b7:53:92"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6186aeb91badfee61d970d596469707dfab75392/; sid:903202576; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"95:67:8e:05:29:47:3b:f8:b2:97:01:0a:c0:8e:9f:59:75:df:b8:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95678e0529473bf8b297010ac08e9f5975dfb873/; sid:903202577; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"6b:b0:fa:cc:3a:17:02:36:63:4a:92:b6:2f:c6:e6:77:05:da:3f:bf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6bb0facc3a170236634a92b62fc6e67705da3fbf/; sid:903202578; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"8c:b6:48:6f:88:e6:f2:29:a4:55:0c:98:cb:9b:4d:a7:cd:47:5b:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8cb6486f88e6f229a4550c98cb9b4da7cd475b5a/; sid:903202579; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"37:83:44:80:35:25:c8:2d:3e:13:4d:cd:22:22:cf:2c:fa:b0:c3:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/378344803525c82d3e134dcd2222cf2cfab0c338/; sid:903202580; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e7:ec:c9:43:ad:1c:50:e4:16:f7:e7:d0:ec:25:d5:9d:28:24:98:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7ecc943ad1c50e416f7e7d0ec25d59d282498ba/; sid:903202581; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"45:b6:c8:ce:24:f4:3e:f7:6a:0d:6c:17:2a:05:c0:ca:dc:a2:37:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/45b6c8ce24f43ef76a0d6c172a05c0cadca23767/; sid:903202582; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ba:30:74:27:81:6d:18:40:43:38:bc:c8:c9:80:2c:77:6f:de:ec:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba307427816d18404338bcc8c9802c776fdeec95/; sid:903202583; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"24:27:26:51:5b:55:01:f1:df:9e:2d:bd:8b:3b:df:4c:e2:fe:d3:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/242726515b5501f1df9e2dbd8b3bdf4ce2fed3a9/; sid:903202584; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c7:a8:be:1f:b4:71:f0:a1:ed:85:72:a1:0d:21:18:01:c3:32:7a:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c7a8be1fb471f0a1ed8572a10d211801c3327add/; sid:903202585; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"23:e7:90:82:bb:21:e2:0d:ea:f5:38:63:da:64:59:ad:f0:4c:0f:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/23e79082bb21e20deaf53863da6459adf04c0f33/; sid:903202586; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"6c:bd:84:b6:93:54:72:bc:4b:10:18:92:fc:5c:cd:77:ce:29:64:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cbd84b6935472bc4b101892fc5ccd77ce2964a6/; sid:903202587; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"d3:6a:68:52:ee:bf:98:6c:2d:6f:79:6f:ab:28:09:7b:db:81:60:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d36a6852eebf986c2d6f796fab28097bdb8160c4/; sid:903202588; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"ff:05:d5:0d:6b:2e:f0:30:d6:2a:be:5a:c2:a4:50:d2:7c:28:00:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff05d50d6b2ef030d62abe5ac2a450d27c28004b/; sid:903202589; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4c:fa:ad:ec:5c:b5:e4:ac:6f:d7:54:21:a6:ac:cb:7a:5f:e9:09:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4cfaadec5cb5e4ac6fd75421a6accb7a5fe909e1/; sid:903202590; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Loki C&C)"; tls_cert_fingerprint; content:"d7:79:c7:3c:af:d2:c0:12:b1:34:b3:c0:39:de:24:86:5b:c7:82:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d779c73cafd2c012b134b3c039de24865bc78288/; sid:903202591; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"8c:76:ad:34:07:40:75:f4:dc:9a:7a:1c:29:32:93:73:9b:2c:fd:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c76ad34074075f4dc9a7a1c293293739b2cfdc0/; sid:903202592; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (NetWire C&C)"; tls_cert_fingerprint; content:"97:74:32:d5:a8:46:a3:d8:69:a6:be:e2:f7:c1:5d:51:9a:e9:d9:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/977432d5a846a3d869a6bee2f7c15d519ae9d9a0/; sid:903202593; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"7c:53:95:5e:d3:31:be:72:8c:dd:a7:19:8a:8f:19:10:51:45:72:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7c53955ed331be728cdda7198a8f191051457266/; sid:903202594; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e7:f8:d9:44:f4:a6:ee:9e:7b:d9:ae:6f:e3:7e:2a:79:c9:f7:a9:1c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e7f8d944f4a6ee9e7bd9ae6fe37e2a79c9f7a91c/; sid:903202595; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"9a:5c:d3:e9:90:9d:74:35:84:95:7b:c9:c8:8b:34:d9:3e:d7:87:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a5cd3e9909d743584957bc9c88b34d93ed78761/; sid:903202596; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"98:82:dd:65:37:6a:4b:6e:93:5e:4d:b3:6b:5e:f6:0e:a1:35:16:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9882dd65376a4b6e935e4db36b5ef60ea135164b/; sid:903202597; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"a2:67:72:cc:0b:66:ca:18:9d:36:a0:76:16:60:7f:74:51:e3:51:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a26772cc0b66ca189d36a07616607f7451e35125/; sid:903202598; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d0:2b:de:77:9e:85:3c:84:61:7f:ac:74:0b:cd:47:65:9a:f2:f3:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d02bde779e853c84617fac740bcd47659af2f375/; sid:903202599; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b2:dc:f0:be:ee:69:18:13:65:a7:da:7a:d4:92:1b:cf:f9:64:61:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2dcf0beee69181365a7da7ad4921bcff96461ec/; sid:903202600; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"5f:83:c8:d6:40:c1:72:cd:f7:5f:72:3c:3d:2e:5c:ae:95:5b:e8:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f83c8d640c172cdf75f723c3d2e5cae955be89a/; sid:903202601; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"93:ba:dc:9f:18:a7:08:52:a7:a5:c0:46:41:f5:a0:2a:d5:31:69:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93badc9f18a70852a7a5c04641f5a02ad53169c8/; sid:903202602; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"91:a4:7b:29:99:12:f1:20:4f:db:e2:97:4e:27:26:2b:f8:9a:0a:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/91a47b299912f1204fdbe2974e27262bf89a0a06/; sid:903202603; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5c:19:cc:1f:79:f6:8f:54:2a:5f:31:34:9b:48:79:83:10:c9:f1:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c19cc1f79f68f542a5f31349b48798310c9f1e4/; sid:903202604; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f1:0c:6f:69:a0:25:24:54:79:2f:c3:cb:cd:d7:f0:e7:ba:b3:bb:2b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f10c6f69a0252454792fc3cbcdd7f0e7bab3bb2b/; sid:903202605; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b8:e3:ed:1b:b5:9b:ac:1a:0d:18:72:5e:75:1a:7b:43:b4:62:df:59"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b8e3ed1bb59bac1a0d18725e751a7b43b462df59/; sid:903202606; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"fd:3a:17:32:fc:5b:27:2d:16:7a:5d:40:1e:bb:86:ce:6d:4a:bd:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd3a1732fc5b272d167a5d401ebb86ce6d4abd48/; sid:903202607; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a2:31:e4:7b:96:ad:21:0c:1f:d5:00:ac:54:33:82:d0:e5:f0:78:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a231e47b96ad210c1fd500ac543382d0e5f07871/; sid:903202608; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"86:61:4a:67:6d:06:9e:27:da:e4:eb:6e:e6:db:1d:98:36:97:ea:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86614a676d069e27dae4eb6ee6db1d983697ea48/; sid:903202609; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware distribution)"; tls_cert_fingerprint; content:"fc:06:d5:03:eb:38:49:a3:06:7f:32:d7:6e:e2:24:cb:83:df:91:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc06d503eb3849a3067f32d76ee224cb83df91e8/; sid:903202610; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"be:b3:57:74:f7:d6:29:41:67:ee:03:a9:15:e7:9c:3b:b9:5e:0a:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/beb35774f7d6294167ee03a915e79c3bb95e0acd/; sid:903202611; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c2:7b:5b:b9:72:3e:34:77:48:8d:60:4b:c3:90:6f:9d:78:f2:d7:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c27b5bb9723e3477488d604bc3906f9d78f2d701/; sid:903202612; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"88:1a:ce:0d:30:fd:b1:ca:08:78:96:47:bb:55:fc:40:bc:2e:fc:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/881ace0d30fdb1ca08789647bb55fc40bc2efc13/; sid:903202613; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Zebrocy C&C)"; tls_cert_fingerprint; content:"30:73:67:5b:92:c8:e2:42:fa:f3:64:e3:fa:a5:7b:60:11:b7:71:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3073675b92c8e242faf364e3faa57b6011b77184/; sid:903202614; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"89:38:a6:d4:96:33:4e:1d:cf:7c:e0:2f:8e:3d:c9:e5:59:06:90:aa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8938a6d496334e1dcf7ce02f8e3dc9e5590690aa/; sid:903202615; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"91:6b:a4:8c:05:fc:16:b7:39:d6:dc:cf:b5:1d:2f:0c:57:68:df:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/916ba48c05fc16b739d6dccfb51d2f0c5768df20/; sid:903202616; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c4:c7:85:ae:a2:c1:df:aa:b8:44:c4:4f:22:a7:1e:9c:65:29:6e:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4c785aea2c1dfaab844c44f22a71e9c65296e79/; sid:903202617; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"54:90:61:5e:13:fd:a2:92:cc:46:b5:c5:0a:63:9c:da:c2:6d:c0:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5490615e13fda292cc46b5c50a639cdac26dc07a/; sid:903202618; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"fb:65:e6:17:6c:22:52:71:01:f6:5e:12:38:84:dc:55:b3:aa:85:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb65e6176c22527101f65e123884dc55b3aa8593/; sid:903202619; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"4a:3a:4e:20:c5:20:7e:f8:34:e7:fe:f6:fb:f8:9f:e0:59:69:d2:a2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a3a4e20c5207ef834e7fef6fbf89fe05969d2a2/; sid:903202620; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PredatorStealer C&C)"; tls_cert_fingerprint; content:"ec:5d:a2:14:56:fb:52:c5:83:f4:2c:ad:d3:d1:01:2f:4a:10:ac:42"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ec5da21456fb52c583f42cadd3d1012f4a10ac42/; sid:903202621; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ef:a8:c5:eb:a6:b4:d0:a7:4f:aa:9b:a8:35:b2:4b:be:3b:01:bd:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/efa8c5eba6b4d0a74faa9ba835b24bbe3b01bd99/; sid:903202622; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"b0:e5:93:55:af:6b:fb:e6:69:74:f1:c0:d3:8a:93:a3:51:97:46:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0e59355af6bfbe66974f1c0d38a93a351974679/; sid:903202623; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"11:06:c3:95:fd:9f:92:81:63:2b:71:2b:b3:4e:ff:dc:b9:01:63:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1106c395fd9f9281632b712bb34effdcb9016378/; sid:903202624; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ba:3c:94:3a:48:61:54:ca:de:ca:7e:14:e0:de:11:e9:e4:81:9f:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba3c943a486154cadeca7e14e0de11e9e4819f27/; sid:903202625; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"db:9f:d1:a3:56:c0:dd:0b:df:8c:3e:19:e1:d4:da:5d:73:42:88:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db9fd1a356c0dd0bdf8c3e19e1d4da5d7342883e/; sid:903202626; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"bb:02:79:1f:e1:b4:4c:69:e3:8d:2b:c7:b8:24:74:9c:57:ae:bb:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb02791fe1b44c69e38d2bc7b824749c57aebb13/; sid:903202627; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"59:62:9a:72:df:fb:81:c2:05:42:98:39:76:74:20:00:59:e4:a9:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59629a72dffb81c2054298397674200059e4a910/; sid:903202628; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"db:c2:69:e4:38:ec:2e:d7:59:2d:40:d4:35:7e:c0:a4:ed:09:20:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbc269e438ec2ed7592d40d4357ec0a4ed0920ec/; sid:903202629; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"04:7d:cf:71:ad:69:0d:3a:d4:93:23:3a:24:cd:ab:d0:59:93:f0:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/047dcf71ad690d3ad493233a24cdabd05993f04e/; sid:903202630; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"4c:f3:59:be:1c:88:49:b7:85:c3:3e:4f:da:f1:3f:48:22:8b:8d:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4cf359be1c8849b785c33e4fdaf13f48228b8def/; sid:903202631; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"5b:ed:e8:36:fa:11:62:bf:19:a1:ba:2d:f9:7d:ae:8c:2c:bd:6d:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5bede836fa1162bf19a1ba2df97dae8c2cbd6dce/; sid:903202632; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Smoke Loader C&C)"; tls_cert_fingerprint; content:"ef:b9:eb:a1:4b:82:10:a2:7a:72:d7:da:45:50:ad:44:45:dc:50:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/efb9eba14b8210a27a72d7da4550ad4445dc5024/; sid:903202633; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d1:ac:88:71:c0:11:5e:68:60:1f:1f:93:db:a8:21:d2:dd:09:33:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1ac8871c0115e68601f1f93dba821d2dd0933f3/; sid:903202634; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c3:6a:68:7d:6a:5d:d2:92:62:74:4a:15:2a:cb:4d:07:32:03:f3:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c36a687d6a5dd29262744a152acb4d073203f389/; sid:903202635; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"32:db:2f:1d:8b:39:a3:12:6d:e2:30:93:65:9d:cb:90:17:92:37:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32db2f1d8b39a3126de23093659dcb90179237b0/; sid:903202636; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"a5:6a:f2:33:b0:c4:57:d0:bc:dc:a5:a5:ac:08:4b:67:d7:38:e3:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a56af233b0c457d0bcdca5a5ac084b67d738e3ff/; sid:903202637; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"92:d8:8c:fe:0b:ed:5b:10:a2:a1:e8:db:a3:6c:af:e8:e8:fb:45:f5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/92d88cfe0bed5b10a2a1e8dba36cafe8e8fb45f5/; sid:903202638; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"9f:91:0c:6a:b3:00:a3:67:e9:7f:54:08:28:a6:ea:e9:74:aa:45:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9f910c6ab300a367e97f540828a6eae974aa4515/; sid:903202639; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"44:fc:f5:1b:2f:b5:5e:fe:33:66:ef:27:77:a4:95:91:77:b9:c2:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44fcf51b2fb55efe3366ef2777a4959177b9c2be/; sid:903202640; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"38:a0:cf:1a:72:4c:49:8a:e9:bd:64:c0:77:a6:0c:42:32:ff:ea:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38a0cf1a724c498ae9bd64c077a60c4232ffeab3/; sid:903202641; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"95:fe:aa:57:4c:70:86:6e:1b:20:30:d3:1b:0b:b4:48:ce:c3:5c:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95feaa574c70866e1b2030d31b0bb448cec35c8a/; sid:903202642; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"c0:a4:84:25:90:f5:06:b2:bd:e4:26:60:68:08:76:db:f1:07:3b:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c0a4842590f506b2bde42660680876dbf1073b17/; sid:903202643; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"01:4e:ab:17:84:6f:60:7b:15:64:21:ba:4a:b4:2d:8e:2d:72:47:b4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/014eab17846f607b156421ba4ab42d8e2d7247b4/; sid:903202644; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"75:8c:14:71:e8:76:41:84:e4:ec:43:44:41:9c:68:8d:5b:7f:52:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/758c1471e8764184e4ec4344419c688d5b7f52af/; sid:903202645; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"85:0c:e5:44:ab:68:87:5c:bc:35:10:de:80:50:a3:78:78:ad:6e:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/850ce544ab68875cbc3510de8050a37878ad6ee4/; sid:903202646; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"9c:26:b4:f3:b3:7e:81:17:f9:71:35:96:b9:c1:25:96:28:ea:1d:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9c26b4f3b37e8117f9713596b9c1259628ea1dee/; sid:903202647; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"82:64:b3:52:0a:1d:92:7a:3b:b5:af:19:f6:6b:b8:97:a8:d8:85:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8264b3520a1d927a3bb5af19f66bb897a8d885fd/; sid:903202648; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"e0:2d:cd:bd:af:bd:c8:36:dc:b3:5f:d1:c6:1f:f7:db:f6:88:68:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e02dcdbdafbdc836dcb35fd1c61ff7dbf6886865/; sid:903202649; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4a:d2:2d:ac:e3:7d:1c:e4:45:4e:a0:d0:2d:eb:d5:8e:f4:3d:66:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ad22dace37d1ce4454ea0d02debd58ef43d660b/; sid:903202650; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"10:b3:56:0d:b0:c7:74:46:be:f4:87:ec:e9:c5:d2:6c:f6:e8:d0:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10b3560db0c77446bef487ece9c5d26cf6e8d0e9/; sid:903202651; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"69:96:0a:ca:ec:a0:35:28:47:d8:87:94:bd:31:7e:7a:a0:e3:8a:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69960acaeca0352847d88794bd317e7aa0e38a7e/; sid:903202652; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f6:6e:2e:8a:a5:83:8d:39:1c:49:0f:70:f2:3a:6b:34:48:83:23:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f66e2e8aa5838d391c490f70f23a6b34488323a8/; sid:903202653; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"45:00:3a:24:f2:3f:d0:76:d3:ba:50:e9:aa:1f:69:af:ad:f1:8c:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/45003a24f23fd076d3ba50e9aa1f69afadf18cd1/; sid:903202654; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"36:67:f5:99:b3:5d:29:fd:08:3a:87:8e:3a:77:6b:6e:b6:66:f5:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3667f599b35d29fd083a878e3a776b6eb666f58e/; sid:903202655; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"38:e1:c4:8d:fe:29:df:43:54:7c:c3:c1:d0:36:ae:bb:c9:e1:d3:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38e1c48dfe29df43547cc3c1d036aebbc9e1d3bb/; sid:903202656; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"b6:44:bd:c6:b7:40:6d:08:e8:39:b9:8b:97:e1:cc:30:9a:00:e6:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b644bdc6b7406d08e839b98b97e1cc309a00e60c/; sid:903202657; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8c:6e:e9:c3:f5:cb:e0:5a:7c:ab:dd:47:4a:89:bf:c2:dc:ce:4e:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c6ee9c3f5cbe05a7cabdd474a89bfc2dcce4e17/; sid:903202658; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"f7:7e:84:d1:0f:f0:b2:93:b6:c7:07:b9:bb:79:bb:0a:cf:88:07:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f77e84d10ff0b293b6c707b9bb79bb0acf8807a6/; sid:903202659; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"20:d6:6b:71:74:9f:52:09:2f:b9:e2:af:ea:a2:b9:cc:e8:a5:75:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20d66b71749f52092fb9e2afeaa2b9cce8a57520/; sid:903202660; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8a:dc:ad:74:16:7f:5b:27:d4:7a:4f:62:9d:11:aa:18:77:10:fd:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8adcad74167f5b27d47a4f629d11aa187710fd41/; sid:903202661; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"71:12:c5:02:62:5c:ec:0a:02:11:71:4f:8d:5c:29:72:86:89:63:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7112c502625cec0a0211714f8d5c2972868963d4/; sid:903202662; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"2f:b8:c4:60:29:4b:26:de:7e:a3:c7:64:7c:52:68:84:12:58:11:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2fb8c460294b26de7ea3c7647c5268841258113e/; sid:903202663; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gootkit C&C)"; tls_cert_fingerprint; content:"34:4d:47:f3:40:f5:35:f5:30:1e:6d:7a:6d:07:cf:05:be:1e:f7:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/344d47f340f535f5301e6d7a6d07cf05be1ef7d4/; sid:903202664; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CobaltStrike C&C)"; tls_cert_fingerprint; content:"dd:b5:9d:8c:c9:36:88:bb:f4:92:5c:7d:27:46:2b:70:e5:32:25:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddb59d8cc93688bbf4925c7d27462b70e53225cb/; sid:903202665; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d8:58:31:5e:4c:36:dd:7d:51:c9:84:01:fc:90:33:e3:71:41:14:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d858315e4c36dd7d51c98401fc9033e3714114d9/; sid:903202666; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ba:87:5b:e4:74:a8:c9:c3:2d:e8:b1:e4:4c:36:36:7c:ac:ba:5c:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba875be474a8c9c32de8b1e44c36367cacba5ca9/; sid:903202667; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e2:e6:13:2d:87:11:90:32:83:d2:db:76:4e:25:9b:d5:81:b5:26:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e2e6132d8711903283d2db764e259bd581b526ee/; sid:903202668; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"79:72:b9:a8:96:45:d7:69:6e:d0:54:2a:8b:94:4f:dc:24:f4:7f:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7972b9a89645d7696ed0542a8b944fdc24f47fb2/; sid:903202669; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ae:1a:40:00:be:2c:83:51:16:1a:f7:21:c8:a8:29:7a:a3:18:fa:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae1a4000be2c8351161af721c8a8297aa318fa82/; sid:903202670; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"f5:19:18:bb:c3:2a:6d:be:2b:3c:4f:34:64:b2:47:43:5a:2f:06:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f51918bbc32a6dbe2b3c4f3464b247435a2f064b/; sid:903202671; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"af:74:24:d7:b3:88:bd:98:13:45:e5:55:a6:75:f1:56:87:5b:52:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/af7424d7b388bd981345e555a675f156875b52ec/; sid:903202672; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"50:9d:f0:2a:70:22:bb:5d:a8:5f:cf:55:6b:ac:68:9d:66:4d:6d:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/509df02a7022bb5da85fcf556bac689d664d6d4c/; sid:903202673; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a5:5a:87:24:50:41:04:e5:b7:9a:d8:35:df:80:df:94:89:37:2f:d8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a55a8724504104e5b79ad835df80df9489372fd8/; sid:903202674; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"53:6c:7f:a5:5b:b4:20:78:b3:19:b5:19:7e:6a:eb:f9:ce:f3:db:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/536c7fa55bb42078b319b5197e6aebf9cef3db72/; sid:903202675; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"5e:46:91:b5:67:c8:ab:03:31:6c:7f:58:3c:d8:0a:13:3c:e4:91:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e4691b567c8ab03316c7f583cd80a133ce4917e/; sid:903202676; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"13:4e:5e:e1:f8:d4:c3:52:4b:f0:c7:0d:61:48:b6:25:12:a7:b8:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/134e5ee1f8d4c3524bf0c70d6148b62512a7b81b/; sid:903202677; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"60:a7:b1:0e:07:04:65:b9:59:eb:18:a9:e8:10:0f:dd:c6:20:2f:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60a7b10e070465b959eb18a9e8100fddc6202f34/; sid:903202678; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"f2:43:f6:f5:87:b9:36:a6:aa:b9:95:1a:1e:0b:97:ad:aa:5c:2d:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f243f6f587b936a6aab9951a1e0b97adaa5c2d9c/; sid:903202679; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e1:b2:0d:36:a9:ea:dd:5d:88:49:3e:4c:eb:fd:0a:ea:a6:b2:7d:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1b20d36a9eadd5d88493e4cebfd0aeaa6b27ddc/; sid:903202680; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6c:08:88:5c:2a:ba:f9:ad:f0:84:0d:a1:cb:e7:c9:de:be:73:6b:2e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6c08885c2abaf9adf0840da1cbe7c9debe736b2e/; sid:903202681; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f9:96:f8:7d:90:52:a7:b6:44:2b:ae:48:8d:df:15:16:7c:dd:0a:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f996f87d9052a7b6442bae488ddf15167cdd0a56/; sid:903202682; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"70:d4:19:af:c7:42:e4:56:b4:42:ca:fd:24:d7:03:b7:c7:ae:01:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/70d419afc742e456b442cafd24d703b7c7ae0193/; sid:903202683; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c9:2a:c9:79:7c:30:f7:88:cd:4b:28:0e:d5:e0:cf:74:e9:30:60:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c92ac9797c30f788cd4b280ed5e0cf74e930603a/; sid:903202684; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e5:72:f2:a6:cf:c4:38:59:4a:f7:12:ea:06:3d:97:b3:a5:e0:43:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e572f2a6cfc438594af712ea063d97b3a5e0435e/; sid:903202685; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"00:8d:33:ce:2e:5d:35:83:d8:eb:b1:15:f7:2b:25:09:75:75:70:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/008d33ce2e5d3583d8ebb115f72b250975757018/; sid:903202686; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"cf:3b:ee:45:f8:78:27:fa:2c:5d:db:c5:09:87:ac:6a:5e:5a:ba:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf3bee45f87827fa2c5ddbc50987ac6a5e5aba6c/; sid:903202687; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7d:c5:16:b0:43:6d:c0:be:82:96:dc:b6:75:cb:96:a8:19:fe:0f:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7dc516b0436dc0be8296dcb675cb96a819fe0f68/; sid:903202688; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"3a:9c:06:6e:76:bd:13:f2:e4:c6:08:59:d7:b4:d9:ff:6e:66:6c:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a9c066e76bd13f2e4c60859d7b4d9ff6e666cf0/; sid:903202689; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"60:26:0a:f7:e0:1f:04:1e:44:c5:c7:b9:10:67:26:7e:90:b4:8f:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60260af7e01f041e44c5c7b91067267e90b48f7a/; sid:903202690; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6c:39:73:dc:d6:84:e1:b4:eb:41:d9:c5:b6:ca:c5:62:fa:87:c6:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6c3973dcd684e1b4eb41d9c5b6cac562fa87c67a/; sid:903202691; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"65:45:00:6a:b4:1b:38:bb:c2:18:11:70:92:71:73:bd:ee:ab:b5:bc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6545006ab41b38bbc2181170927173bdeeabb5bc/; sid:903202692; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"f6:58:38:a9:8e:2b:13:fe:1e:67:64:8d:8d:db:f9:11:ba:e2:32:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f65838a98e2b13fe1e67648d8ddbf911bae2329b/; sid:903202693; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"13:52:05:db:70:a8:08:7c:c8:55:74:69:24:a6:27:56:47:bd:1c:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/135205db70a8087cc855746924a6275647bd1c3d/; sid:903202694; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5f:51:04:9f:3f:47:b4:ec:35:50:31:c0:8e:4d:ae:b1:ff:40:b5:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f51049f3f47b4ec355031c08e4daeb1ff40b52a/; sid:903202695; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"fc:67:ab:8e:0f:63:5f:00:d8:ea:55:6f:d9:8c:0f:56:13:05:7b:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc67ab8e0f635f00d8ea556fd98c0f5613057b56/; sid:903202696; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"04:63:a5:f0:2f:7e:ed:1a:79:7a:1b:0f:f0:8a:0b:62:63:9e:7b:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0463a5f02f7eed1a797a1b0ff08a0b62639e7be0/; sid:903202697; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"91:15:ed:8c:d0:e1:90:b5:62:9a:ca:39:96:b8:64:01:51:55:a3:33"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9115ed8cd0e190b5629aca3996b864015155a333/; sid:903202698; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"fa:04:ad:17:15:28:f9:b7:16:68:7c:29:12:a2:25:7b:37:bd:4e:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa04ad171528f9b716687c2912a2257b37bd4eb5/; sid:903202699; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"de:28:1b:03:31:35:23:90:c2:97:7e:d3:9e:4c:62:47:2d:2d:ab:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de281b0331352390c2977ed39e4c62472d2dabe4/; sid:903202700; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"fe:15:30:7f:cf:a1:98:58:bb:54:96:1a:8e:19:3f:1f:3f:5b:cf:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe15307fcfa19858bb54961a8e193f1f3f5bcf44/; sid:903202701; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"80:c8:32:7f:b0:22:63:78:d1:00:9e:74:9c:5e:91:21:df:9a:75:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80c8327fb0226378d1009e749c5e9121df9a7524/; sid:903202702; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"91:6c:be:db:7b:91:1a:80:ca:de:f2:fb:a8:ef:65:e1:75:00:50:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/916cbedb7b911a80cadef2fba8ef65e17500503f/; sid:903202703; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"15:e7:39:1b:57:d7:d6:10:aa:60:83:6d:d8:db:bb:af:57:b0:78:82"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15e7391b57d7d610aa60836dd8dbbbaf57b07882/; sid:903202704; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6a:39:a5:3b:51:79:6f:0a:32:d5:5d:1e:fd:55:00:10:f3:11:e8:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6a39a53b51796f0a32d55d1efd550010f311e8ef/; sid:903202705; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8c:24:b6:03:dc:1d:57:da:f5:7c:53:d1:c2:9c:8a:d2:94:2f:7b:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c24b603dc1d57daf57c53d1c29c8ad2942f7b7c/; sid:903202706; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"16:04:65:7c:34:62:7b:d6:9a:e1:f8:85:bf:4a:88:70:c7:89:cd:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1604657c34627bd69ae1f885bf4a8870c789cddf/; sid:903202707; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"18:de:fc:22:07:2e:af:19:4b:f7:22:36:2e:22:2b:e2:19:45:9e:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/18defc22072eaf194bf722362e222be219459e20/; sid:903202708; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1c:c9:67:9b:0f:86:57:5f:b5:84:b2:c2:a3:c2:c3:51:97:08:33:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1cc9679b0f86575fb584b2c2a3c2c3519708333f/; sid:903202709; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"16:e0:6a:88:db:b1:0c:75:07:77:80:d4:ba:ed:6d:0b:27:33:f9:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/16e06a88dbb10c75077780d4baed6d0b2733f985/; sid:903202710; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6e:f4:fa:e0:9e:f3:a3:fc:81:e2:1d:a6:f4:7a:8c:b9:b2:99:6a:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6ef4fae09ef3a3fc81e21da6f47a8cb9b2996af4/; sid:903202711; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"0d:bd:1e:ea:34:54:61:fc:7d:0a:fe:92:e4:d8:49:0b:00:47:9a:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dbd1eea345461fc7d0afe92e4d8490b00479afa/; sid:903202712; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"dd:ae:0c:37:e8:3a:8f:1d:9b:a9:a9:28:52:98:59:17:43:59:0e:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ddae0c37e83a8f1d9ba9a9285298591743590ed5/; sid:903202713; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"55:d7:2e:3e:7c:44:50:b2:f1:35:6d:ce:d3:be:70:6c:b4:88:64:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/55d72e3e7c4450b2f1356dced3be706cb48864d0/; sid:903202714; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d3:a8:15:2a:00:f4:25:dc:cd:75:35:ff:cf:df:4c:cd:33:da:c2:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3a8152a00f425dccd7535ffcfdf4ccd33dac2f8/; sid:903202715; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"08:70:50:6a:75:dd:2e:4a:92:0f:df:39:f5:b3:de:16:49:93:df:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0870506a75dd2e4a920fdf39f5b3de164993df1f/; sid:903202716; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"33:6c:3c:cd:a3:69:bf:0c:6e:49:86:22:e4:3d:9a:6f:2e:9c:f7:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/336c3ccda369bf0c6e498622e43d9a6f2e9cf76f/; sid:903202717; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"10:ec:90:3d:02:7a:1f:35:26:8d:d5:3a:f5:be:5f:d2:c7:e3:89:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10ec903d027a1f35268dd53af5be5fd2c7e3892a/; sid:903202718; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"87:5a:1c:f4:a0:d5:d6:4b:87:dd:47:36:c8:ec:b4:a2:d4:01:d1:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/875a1cf4a0d5d64b87dd4736c8ecb4a2d401d13e/; sid:903202719; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"ba:5a:62:49:7e:fa:9a:50:9c:2e:b8:df:28:c9:16:15:c9:af:d1:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ba5a62497efa9a509c2eb8df28c91615c9afd1d1/; sid:903202720; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"00:22:a1:82:1c:4c:ae:59:ac:39:18:e4:dc:be:7c:5c:29:bc:bb:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0022a1821c4cae59ac3918e4dcbe7c5c29bcbbc6/; sid:903202721; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"38:2e:2f:e1:ca:91:b4:26:82:7a:12:7d:93:ae:ef:8c:05:35:e9:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/382e2fe1ca91b426827a127d93aeef8c0535e95f/; sid:903202722; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d4:ef:49:24:4a:3e:94:bd:e7:a6:ef:69:e7:c7:09:5c:d3:94:45:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d4ef49244a3e94bde7a6ef69e7c7095cd3944500/; sid:903202723; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"15:b4:cb:de:c2:d2:ec:1b:2a:44:88:39:fe:73:d6:c2:d5:b3:e0:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15b4cbdec2d2ec1b2a448839fe73d6c2d5b3e0ff/; sid:903202724; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a6:10:c8:03:df:57:0d:50:57:4c:00:46:83:a7:15:7b:bd:d7:1d:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a610c803df570d50574c004683a7157bbdd71dfa/; sid:903202725; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c8:72:6c:6d:97:d5:d4:ae:c5:b9:18:a7:42:06:21:72:b6:8c:bc:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c8726c6d97d5d4aec5b918a742062172b68cbc3a/; sid:903202726; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"39:1a:54:c4:1d:8d:ac:78:9a:87:49:be:a9:6d:81:fe:81:53:44:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/391a54c41d8dac789a8749bea96d81fe8153448f/; sid:903202727; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"dd:09:66:fb:66:cc:22:78:3d:1a:fc:06:e6:dc:8c:42:6a:cc:a9:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd0966fb66cc22783d1afc06e6dc8c426acca926/; sid:903202728; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"79:8d:6f:8e:46:9e:73:ce:ae:4d:be:da:4c:f1:77:43:e3:c6:5f:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/798d6f8e469e73ceae4dbeda4cf17743e3c65f3a/; sid:903202729; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"6b:5b:77:98:f8:bb:ad:bd:6d:34:94:12:9e:48:1e:f9:fa:d8:a7:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b5b7798f8bbadbd6d3494129e481ef9fad8a7ac/; sid:903202730; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"dc:13:06:d5:d7:e2:4d:24:af:3c:a8:a8:7e:2b:26:f8:be:2d:ea:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc1306d5d7e24d24af3ca8a87e2b26f8be2dea45/; sid:903202731; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b5:8a:b8:7f:55:4b:5c:99:aa:a0:48:d5:6a:03:0f:28:c4:39:77:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b58ab87f554b5c99aaa048d56a030f28c43977a4/; sid:903202732; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TrickBot C&C)"; tls_cert_fingerprint; content:"9a:03:4b:35:0f:51:73:22:a9:f8:e9:0d:57:74:51:91:08:c4:f2:99"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a034b350f517322a9f8e90d5774519108c4f299/; sid:903202733; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"5f:63:6d:33:60:70:0e:95:6a:2c:58:b6:dc:45:b7:a9:a7:48:4f:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f636d3360700e956a2c58b6dc45b7a9a7484f6b/; sid:903202734; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e3:4f:0a:7d:95:99:2d:75:4c:78:ba:d7:d3:07:c7:eb:01:29:0a:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e34f0a7d95992d754c78bad7d307c7eb01290a05/; sid:903202735; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1f:1b:5b:22:78:5b:41:89:05:04:7f:62:dc:39:2f:65:7b:49:76:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f1b5b22785b418905047f62dc392f657b49761f/; sid:903202736; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"23:0f:98:67:3b:09:56:f8:65:2b:ab:02:20:a0:10:f8:3d:38:1f:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/230f98673b0956f8652bab0220a010f83d381f4c/; sid:903202737; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"0a:d3:c3:52:ff:ec:da:a0:a1:4c:55:66:39:14:6e:49:7d:1b:97:1b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0ad3c352ffecdaa0a14c556639146e497d1b971b/; sid:903202738; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"0d:f1:b6:e7:51:4f:b4:e7:28:14:4d:9b:2a:bf:68:42:38:b1:00:0b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0df1b6e7514fb4e728144d9b2abf684238b1000b/; sid:903202739; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"18:88:d4:25:28:55:80:2d:9b:79:8b:13:0d:4f:65:6d:89:ac:ed:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1888d4252855802d9b798b130d4f656d89aced55/; sid:903202740; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"98:22:95:60:c6:34:9e:a0:54:d6:71:9f:53:19:a0:a2:53:88:b0:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/98229560c6349ea054d6719f5319a0a25388b08b/; sid:903202741; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cd:47:a9:1b:ba:81:a0:f0:1b:99:20:70:ce:b7:00:1b:5a:90:df:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd47a91bba81a0f01b992070ceb7001b5a90dfb0/; sid:903202742; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3c:39:2d:20:e3:15:77:1d:27:65:56:c7:da:37:07:f0:81:70:1f:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c392d20e315771d276556c7da3707f081701f78/; sid:903202743; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"76:08:87:d6:5b:34:07:46:37:f0:2f:96:0a:b3:b3:a5:9a:37:9b:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/760887d65b34074637f02f960ab3b3a59a379b5d/; sid:903202744; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"81:8c:d9:27:c3:d5:2c:8b:57:6f:9d:aa:2f:96:5a:60:da:c3:be:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/818cd927c3d52c8b576f9daa2f965a60dac3be23/; sid:903202745; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"8b:63:50:10:58:e8:c9:c2:53:ed:23:d1:85:c9:09:31:6b:6d:e0:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8b63501058e8c9c253ed23d185c909316b6de0e7/; sid:903202746; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"bc:f8:55:79:6d:e0:18:a6:31:76:d6:92:0f:b0:b6:c7:08:36:31:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bcf855796de018a63176d6920fb0b6c708363100/; sid:903202747; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1f:19:e7:fa:82:ed:ce:b0:df:f1:22:b0:ff:43:b8:0e:73:6a:2a:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f19e7fa82edceb0dff122b0ff43b80e736a2ad2/; sid:903202748; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"39:79:fd:e3:b5:02:5f:8b:33:1e:e9:0a:99:8b:de:f8:fb:74:1c:6d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3979fde3b5025f8b331ee90a998bdef8fb741c6d/; sid:903202749; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"db:f3:22:88:7f:f4:ae:75:f6:bb:51:f9:29:4a:50:71:99:9a:41:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbf322887ff4ae75f6bb51f9294a5071999a412a/; sid:903202750; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"4b:a4:3c:2c:74:6a:17:d8:42:9a:99:78:27:fd:89:7a:43:64:e2:d6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ba43c2c746a17d8429a997827fd897a4364e2d6/; sid:903202751; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"f8:7d:2a:ff:41:48:f9:8f:01:44:60:ab:70:9c:77:58:7e:a1:e4:30"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f87d2aff4148f98f014460ab709c77587ea1e430/; sid:903202752; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5e:21:f8:04:85:6b:3d:64:d2:1d:5f:af:d5:c0:44:03:fe:c9:43:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e21f804856b3d64d21d5fafd5c04403fec943c8/; sid:903202753; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5e:39:1e:5b:c7:89:03:88:1e:e1:23:e4:4a:22:4d:29:48:04:4e:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5e391e5bc78903881ee123e44a224d2948044eb7/; sid:903202754; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2f:65:39:10:77:63:dd:c6:d4:24:0a:5d:bd:e6:25:b1:83:1a:2e:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2f6539107763ddc6d4240a5dbde625b1831a2e04/; sid:903202755; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"11:26:47:18:92:e6:45:ba:b2:4a:fb:aa:6e:2b:db:97:84:42:5d:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1126471892e645bab24afbaa6e2bdb9784425d04/; sid:903202756; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"eb:8d:f5:0d:4e:d4:c4:05:5d:bc:46:01:c3:f3:ee:31:4f:60:21:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eb8df50d4ed4c4055dbc4601c3f3ee314f602168/; sid:903202757; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"e9:50:61:ed:3d:62:87:3c:22:32:c2:fc:e2:72:44:97:8c:77:b2:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e95061ed3d62873c2232c2fce27244978c77b2d1/; sid:903202758; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"bb:f3:e6:b6:0c:9d:ec:81:0f:cf:f6:cb:12:92:6a:eb:9d:76:e2:98"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bbf3e6b60c9dec810fcff6cb12926aeb9d76e298/; sid:903202759; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"8a:f6:71:bf:0c:5a:e8:40:6e:ef:17:c7:87:75:21:ca:e3:0d:1e:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8af671bf0c5ae8406eef17c7877521cae30d1ed3/; sid:903202760; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"ab:e1:86:52:3f:ba:ea:20:47:2c:b3:0a:36:fc:8a:57:f5:91:9c:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/abe186523fbaea20472cb30a36fc8a57f5919cf6/; sid:903202761; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6b:16:75:35:55:88:ac:8a:dc:1a:87:c3:02:ee:f2:d1:08:68:ca:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b1675355588ac8adc1a87c302eef2d10868caa8/; sid:903202762; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"bc:43:a0:94:65:13:b2:25:0c:78:80:52:22:25:68:be:af:ec:19:52"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc43a0946513b2250c788052222568beafec1952/; sid:903202763; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c5:a5:62:5b:3e:d7:33:f2:f4:fa:83:b7:39:f1:56:a0:42:c7:25:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c5a5625b3ed733f2f4fa83b739f156a042c72566/; sid:903202764; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"50:50:c6:c7:89:d7:1e:a7:af:3e:0a:14:11:29:7c:25:c5:79:45:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5050c6c789d71ea7af3e0a1411297c25c57945ed/; sid:903202765; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (njrat C&C)"; tls_cert_fingerprint; content:"ec:bc:d8:41:f3:3e:c6:a4:0a:26:f3:ff:77:e0:e1:8f:8a:7e:49:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecbcd841f33ec6a40a26f3ff77e0e18f8a7e4949/; sid:903202766; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"30:f4:4f:fb:61:f1:62:16:3e:7a:9f:ed:95:33:ab:25:45:5b:6a:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30f44ffb61f162163e7a9fed9533ab25455b6add/; sid:903202767; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6e:38:3f:6a:df:ca:b3:66:6e:b5:75:2e:7c:1e:59:e0:76:08:54:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6e383f6adfcab3666eb5752e7c1e59e0760854e0/; sid:903202768; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a2:7e:73:18:74:ac:56:90:5e:7b:1b:81:db:55:64:20:fa:ee:98:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a27e731874ac56905e7b1b81db556420faee9868/; sid:903202769; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"09:b5:cd:f6:52:e8:85:ae:8e:d1:ec:f3:ab:ee:01:a1:c0:0b:04:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09b5cdf652e885ae8ed1ecf3abee01a1c00b0448/; sid:903202770; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"2a:fd:a3:72:73:f3:bc:b0:87:63:c3:65:25:bf:ee:f9:27:6d:7b:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2afda37273f3bcb08763c36525bfeef9276d7bee/; sid:903202771; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"93:2a:35:45:1d:9b:0d:16:35:ff:06:22:76:17:9a:fe:ae:69:c6:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/932a35451d9b0d1635ff062276179afeae69c62d/; sid:903202772; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"84:28:2d:72:ef:43:92:69:4b:94:6b:6a:34:ed:66:fa:dd:9f:fb:61"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84282d72ef4392694b946b6a34ed66fadd9ffb61/; sid:903202773; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"7d:0e:5b:26:79:5b:bc:73:e7:8b:d0:a1:50:04:00:86:c9:3c:a0:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7d0e5b26795bbc73e78bd0a150040086c93ca050/; sid:903202774; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"35:a8:8a:63:64:e2:ef:ef:db:a5:89:ec:2c:8a:9e:26:0d:c7:e9:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35a88a6364e2efefdba589ec2c8a9e260dc7e9a0/; sid:903202775; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"ef:87:eb:fa:a1:a3:ea:b6:41:cb:60:2f:6d:7e:b1:25:45:49:43:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef87ebfaa1a3eab641cb602f6d7eb1254549434c/; sid:903202776; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"0d:cc:97:01:d2:b4:d9:16:ce:4e:c4:36:a8:a9:0d:cd:ae:24:cc:b3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0dcc9701d2b4d916ce4ec436a8a90dcdae24ccb3/; sid:903202777; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"93:e7:a0:ba:fd:e1:77:f0:90:fc:96:2c:9e:25:98:33:37:47:64:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93e7a0bafde177f090fc962c9e25983337476473/; sid:903202778; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7b:a2:26:e0:53:8c:23:46:38:be:ae:09:1b:a5:3f:02:82:fa:9f:b6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7ba226e0538c234638beae091ba53f0282fa9fb6/; sid:903202779; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"4c:a0:91:a9:9a:cc:47:c7:3f:94:8a:74:9a:62:1a:9f:50:b5:8a:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ca091a99acc47c73f948a749a621a9f50b58a5e/; sid:903202780; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e8:ab:ea:a1:0e:1b:bc:e2:2c:21:a0:ce:22:62:4d:90:d1:bc:1b:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8abeaa10e1bbce22c21a0ce22624d90d1bc1b6a/; sid:903202781; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (RevCodeRAT C&C)"; tls_cert_fingerprint; content:"60:7c:bc:bd:2e:d6:8c:74:97:c8:a0:70:94:89:f8:76:27:08:5d:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/607cbcbd2ed68c7497c8a0709489f87627085ddc/; sid:903202782; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"78:90:de:c7:1d:55:5e:50:cc:ff:00:fa:c9:94:33:65:b9:6a:23:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7890dec71d555e50ccff00fac9943365b96a23cc/; sid:903202783; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"83:1d:2a:a2:41:2a:6b:68:cd:49:99:d8:1e:0c:f1:57:38:f9:9c:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/831d2aa2412a6b68cd4999d81e0cf15738f99c4e/; sid:903202784; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"a5:62:49:d9:48:26:c1:37:76:65:a6:fe:d5:53:54:d3:21:31:18:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a56249d94826c1377665a6fed55354d321311803/; sid:903202785; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"48:6f:40:e1:9a:9e:3e:a5:3a:10:78:58:11:26:9d:da:df:ef:1e:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/486f40e19a9e3ea53a10785811269ddadfef1e8d/; sid:903202786; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"19:25:20:d8:85:c7:bc:29:28:cb:af:a3:92:41:66:4e:ac:d2:23:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/192520d885c7bc2928cbafa39241664eacd22351/; sid:903202787; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"5d:30:7f:dd:e2:d2:f6:78:05:6c:1b:6e:78:78:fc:89:f4:8f:ed:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5d307fdde2d2f678056c1b6e7878fc89f48fed6f/; sid:903202788; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d3:4a:d0:2f:a2:32:33:b6:49:3e:36:3d:63:37:e8:35:8d:97:47:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d34ad02fa23233b6493e363d6337e8358d9747d7/; sid:903202789; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8b:b6:c7:c3:ab:95:13:15:ac:88:df:cb:12:79:84:ea:03:43:e3:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8bb6c7c3ab951315ac88dfcb127984ea0343e34d/; sid:903202790; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"24:c1:09:a9:3c:82:0c:38:12:f0:be:52:5e:50:88:30:a7:bc:81:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24c109a93c820c3812f0be525e508830a7bc811d/; sid:903202791; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"59:71:1b:d3:b8:23:35:1f:b5:ff:e6:85:10:0a:db:6e:7b:15:49:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59711bd3b823351fb5ffe685100adb6e7b1549cd/; sid:903202792; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"e8:92:d0:0a:bc:af:52:81:e6:d7:5a:e0:a3:3a:88:1c:83:dc:5d:3f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e892d00abcaf5281e6d75ae0a33a881c83dc5d3f/; sid:903202793; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"33:b2:cc:de:b5:9f:88:e8:e0:71:ce:cb:23:c7:02:dc:7f:ee:32:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/33b2ccdeb59f88e8e071cecb23c702dc7fee3227/; sid:903202794; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"25:45:22:39:31:25:8e:62:61:9e:8f:8f:83:f7:13:ec:86:1d:47:be"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2545223931258e62619e8f8f83f713ec861d47be/; sid:903202795; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c4:fe:0b:e3:5a:d3:cc:04:16:50:e8:dc:97:57:04:ee:eb:b9:ec:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c4fe0be35ad3cc041650e8dc975704eeebb9eccf/; sid:903202796; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f5:b7:4b:d5:ce:11:a6:11:40:4d:6c:91:11:3f:47:f6:92:43:e1:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5b74bd5ce11a611404d6c91113f47f69243e1e9/; sid:903202797; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"3e:a5:7c:b7:d6:45:5f:30:e3:d7:e9:42:01:3b:80:80:92:86:7e:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ea57cb7d6455f30e3d7e942013b808092867e3d/; sid:903202798; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4d:39:75:51:7f:83:52:48:a5:c4:28:d2:10:f9:69:73:34:4c:53:4b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4d3975517f835248a5c428d210f96973344c534b/; sid:903202799; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"14:45:44:c8:d0:ce:87:91:b3:d3:2c:fb:77:a2:7f:48:40:a2:fa:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/144544c8d0ce8791b3d32cfb77a27f4840a2fac8/; sid:903202800; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"ae:48:6e:a3:aa:0f:a0:c0:d4:84:f1:02:de:28:60:42:fb:86:0a:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae486ea3aa0fa0c0d484f102de286042fb860a44/; sid:903202801; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"86:48:32:b2:7d:ad:f4:e5:a2:41:cb:d3:8f:0c:ed:26:d8:75:f9:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/864832b27dadf4e5a241cbd38f0ced26d875f946/; sid:903202802; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"f5:1b:dd:17:ab:a2:00:14:68:c9:65:ed:10:d5:01:15:5c:da:cc:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f51bdd17aba2001468c965ed10d501155cdacca1/; sid:903202803; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"04:c3:74:16:1b:21:54:3a:c1:f2:90:0b:65:45:38:e1:64:b5:57:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/04c374161b21543ac1f2900b654538e164b5570a/; sid:903202804; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8d:99:32:7f:fd:97:4b:82:ff:d7:88:64:9d:a4:88:7b:3b:c0:c0:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d99327ffd974b82ffd788649da4887b3bc0c006/; sid:903202805; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"72:20:d8:f5:5a:6b:ae:aa:b5:c6:43:20:01:70:8c:e1:09:ba:bb:a4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7220d8f55a6baeaab5c6432001708ce109babba4/; sid:903202806; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"43:18:d6:68:06:72:f3:3c:22:27:30:a0:b9:e4:a7:cc:57:a7:c1:01"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4318d6680672f33c222730a0b9e4a7cc57a7c101/; sid:903202807; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"fd:b1:b3:15:4f:75:d7:95:72:a3:20:c1:36:3d:d2:56:fd:d3:2f:24"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fdb1b3154f75d79572a320c1363dd256fdd32f24/; sid:903202808; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"b0:40:79:30:dc:d7:c3:86:15:c8:e6:60:c4:d3:91:21:37:5b:11:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0407930dcd7c38615c8e660c4d39121375b1172/; sid:903202809; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"60:42:3a:f3:f1:cd:13:4c:c8:f5:21:9c:f1:28:a1:99:88:33:52:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/60423af3f1cd134cc8f5219cf128a199883352d2/; sid:903202810; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ed:95:a9:9e:d1:c5:48:d8:46:36:98:88:9f:2e:11:3e:a5:43:46:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ed95a99ed1c548d8463698889f2e113ea54346a9/; sid:903202811; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"d1:fe:e1:0f:34:03:12:c8:76:10:64:d6:b1:93:03:6a:c5:fd:36:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1fee10f340312c8761064d6b193036ac5fd36a0/; sid:903202812; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"94:c9:6b:10:a4:3c:6a:48:b4:a2:f0:7d:d0:73:ab:95:8c:c6:1e:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94c96b10a43c6a48b4a2f07dd073ab958cc61e94/; sid:903202813; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"a9:be:ae:4f:e4:b8:03:45:ca:bb:17:fe:d8:2a:cf:e0:48:68:c4:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a9beae4fe4b80345cabb17fed82acfe04868c458/; sid:903202814; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"6d:28:e9:c2:2d:ea:11:8c:b6:2e:54:3f:c3:66:b8:32:60:a8:6e:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d28e9c22dea118cb62e543fc366b83260a86e0d/; sid:903202815; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ce:7f:ab:bc:43:94:51:1c:f9:be:45:d7:76:d2:c9:44:a7:09:b5:3e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce7fabbc4394511cf9be45d776d2c944a709b53e/; sid:903202816; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"b6:6f:d6:79:bd:cc:36:1c:30:36:b3:7f:f1:83:0c:7e:18:e2:58:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b66fd679bdcc361c3036b37ff1830c7e18e25804/; sid:903202817; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"ac:89:4d:d3:a6:2d:49:8c:3f:63:17:a4:5c:d6:e2:2d:cc:f1:bd:d2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac894dd3a62d498c3f6317a45cd6e22dccf1bdd2/; sid:903202818; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"b2:d0:d8:f0:03:f0:6f:10:48:66:e0:d4:16:b4:b7:56:a9:ec:0a:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2d0d8f003f06f104866e0d416b4b756a9ec0aaf/; sid:903202819; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"aa:f8:7e:4d:1b:4c:9e:c7:db:69:45:29:29:32:27:c5:5e:00:0c:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aaf87e4d1b4c9ec7db694529293227c55e000c32/; sid:903202820; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"75:98:8b:85:4b:33:e2:72:c7:58:b2:bd:14:21:92:37:95:de:f0:2c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/75988b854b33e272c758b2bd1421923795def02c/; sid:903202821; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5f:64:10:20:7f:da:5a:bb:e0:1b:9a:dd:33:a7:74:18:e5:67:b7:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f6410207fda5abbe01b9add33a77418e567b71a/; sid:903202822; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"a5:1f:49:92:32:c7:fc:8c:b1:3d:3d:37:20:32:88:26:c5:ef:4b:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a51f499232c7fc8cb13d3d3720328826c5ef4b8b/; sid:903202823; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"75:6d:22:9b:87:5d:e9:51:63:74:93:30:de:2b:61:cf:2d:79:0b:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/756d229b875de95163749330de2b61cf2d790b39/; sid:903202824; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"88:ac:12:a7:fb:e8:28:e7:6d:9a:bb:12:fa:06:5a:7c:d4:7d:91:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88ac12a7fbe828e76d9abb12fa065a7cd47d91c3/; sid:903202825; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"39:fa:8e:88:0e:a3:17:47:75:e1:42:75:bb:46:13:f4:0a:5f:52:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39fa8e880ea3174775e14275bb4613f40a5f522f/; sid:903202826; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"79:46:c5:20:6f:32:ef:54:33:b3:88:40:e7:c3:51:9a:ac:cf:6d:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7946c5206f32ef5433b38840e7c3519aaccf6dbd/; sid:903202827; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"55:3c:bb:17:c6:5d:59:0a:03:74:04:8c:65:48:9c:a9:02:1f:f2:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/553cbb17c65d590a0374048c65489ca9021ff249/; sid:903202828; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"94:af:8c:88:f2:bf:b4:67:6b:2d:bb:c5:82:62:d0:76:78:46:33:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94af8c88f2bfb4676b2dbbc58262d07678463311/; sid:903202829; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"9a:be:56:b1:85:7c:bd:c5:d5:76:fd:99:71:a2:4b:c3:c9:00:92:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9abe56b1857cbdc5d576fd9971a24bc3c9009220/; sid:903202830; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"7f:0a:f1:cb:4f:4d:7d:f7:8d:04:1c:41:11:58:7a:fe:c6:28:41:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7f0af1cb4f4d7df78d041c4111587afec62841e6/; sid:903202831; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"e3:83:88:e7:9c:a7:c5:9f:6c:ba:7a:81:76:76:7b:6f:9c:77:be:cc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e38388e79ca7c59f6cba7a8176767b6f9c77becc/; sid:903202832; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5b:61:e2:84:4b:4d:b1:a4:b1:75:7d:c0:d7:95:90:ae:d7:cb:89:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b61e2844b4db1a4b1757dc0d79590aed7cb89ca/; sid:903202833; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Bolek C&C)"; tls_cert_fingerprint; content:"e8:79:10:5e:d7:21:9b:0b:88:4a:87:73:61:1a:dd:ae:6c:50:6e:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e879105ed7219b0b884a8773611addae6c506e1f/; sid:903202834; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"93:56:b1:52:df:66:34:37:a7:21:96:b5:a1:b4:43:89:e8:5f:f6:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9356b152df663437a72196b5a1b44389e85ff6ac/; sid:903202835; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e0:a0:a4:d3:b7:8a:7d:09:e3:83:d7:ea:06:6a:5c:72:31:eb:09:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e0a0a4d3b78a7d09e383d7ea066a5c7231eb0976/; sid:903202836; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"4c:3a:66:ec:93:87:19:d1:b9:2d:00:18:cf:ed:49:50:0a:a9:aa:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4c3a66ec938719d1b92d0018cfed49500aa9aac6/; sid:903202837; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CobaltStrike C&C)"; tls_cert_fingerprint; content:"9b:aa:51:75:65:2e:63:4c:3f:e4:9d:0a:af:05:dc:ec:88:f2:99:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9baa5175652e634c3fe49d0aaf05dcec88f29965/; sid:903202838; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"e1:86:4e:8f:7f:6d:63:cf:17:5f:98:41:71:84:bb:a1:03:4f:da:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e1864e8f7f6d63cf175f98417184bba1034fda63/; sid:903202839; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"74:5e:f3:ba:79:66:07:bf:12:68:40:e1:a0:f9:fe:f8:64:9b:2d:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/745ef3ba796607bf126840e1a0f9fef8649b2dda/; sid:903202840; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ae:b9:22:4f:65:87:5c:e0:95:c7:92:70:cb:61:64:3f:c0:0a:b2:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aeb9224f65875ce095c79270cb61643fc00ab232/; sid:903202841; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"54:c0:30:c8:d7:b5:6f:42:50:2f:a9:c8:6f:a7:05:57:48:09:44:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54c030c8d7b56f42502fa9c86fa705574809445f/; sid:903202842; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6c:b4:50:b7:3f:cb:23:50:cd:1b:6e:de:f6:39:2a:7e:59:bc:bc:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cb450b73fcb2350cd1b6edef6392a7e59bcbc88/; sid:903202843; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"45:3f:2f:89:5d:94:40:2b:54:61:36:de:d9:f3:46:35:ee:c0:7b:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/453f2f895d94402b546136ded9f34635eec07b70/; sid:903202844; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"ea:fa:d7:4b:b7:ad:56:26:bb:cc:9c:f2:7c:c5:28:a3:9e:40:47:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eafad74bb7ad5626bbcc9cf27cc528a39e4047e6/; sid:903202845; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"f9:3c:c7:c5:58:2b:a5:7a:77:a8:d4:29:96:28:98:f2:d0:8d:82:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f93cc7c5582ba57a77a8d429962898f2d08d82b7/; sid:903202846; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"ce:30:b0:0c:f2:59:d1:f5:e5:27:91:89:53:d1:9e:7d:65:60:e5:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce30b00cf259d1f5e527918953d19e7d6560e5fa/; sid:903202847; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"43:63:26:2d:04:36:54:c2:57:e4:54:1b:3c:b0:14:f4:94:b8:d3:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4363262d043654c257e4541b3cb014f494b8d320/; sid:903202848; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"61:9c:a1:45:04:50:b9:1c:d1:72:b3:09:37:3a:79:c4:59:17:37:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/619ca1450450b91cd172b309373a79c459173787/; sid:903202849; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"f7:4e:35:71:bd:6b:a6:68:0e:fe:3d:4f:2a:ae:c2:cc:ba:60:e5:a5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f74e3571bd6ba6680efe3d4f2aaec2ccba60e5a5/; sid:903202850; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"ef:4d:21:0c:97:77:02:9a:72:92:b6:bd:44:77:a9:9e:6a:02:eb:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef4d210c9777029a7292b6bd4477a99e6a02eb27/; sid:903202851; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ea:99:2c:0b:18:a3:31:35:4a:09:58:a4:a6:d9:6b:2e:ad:99:82:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ea992c0b18a331354a0958a4a6d96b2ead99829b/; sid:903202852; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"88:1e:44:b0:8a:81:0b:2d:87:ac:ca:60:df:f8:84:df:ab:06:49:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/881e44b08a810b2d87acca60dff884dfab064900/; sid:903202853; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"89:31:0b:5c:35:e5:07:26:e8:52:a5:83:42:f5:6e:3d:36:24:46:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89310b5c35e50726e852a58342f56e3d362446f3/; sid:903202854; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"ac:0f:e8:1c:b6:26:2b:0b:78:7c:25:ed:7d:f6:b3:98:70:0c:6d:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac0fe81cb6262b0b787c25ed7df6b398700c6d21/; sid:903202855; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"09:8b:92:9b:42:4b:b0:9c:bc:9f:97:f4:a6:29:b6:c8:85:59:a9:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/098b929b424bb09cbc9f97f4a629b6c88559a971/; sid:903202856; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"2b:06:b5:38:ec:42:5b:54:3c:e2:bd:07:70:17:80:fb:18:68:21:8e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2b06b538ec425b543ce2bd07701780fb1868218e/; sid:903202857; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"2f:b5:d4:e1:69:d7:d0:3b:13:ab:55:46:27:31:c6:ed:43:9b:36:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2fb5d4e169d7d03b13ab55462731c6ed439b363a/; sid:903202858; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e8:a9:f3:0e:99:e3:a9:f6:4e:32:aa:37:5c:2b:0c:2e:ce:06:ad:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8a9f30e99e3a9f64e32aa375c2b0c2ece06ade7/; sid:903202859; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b4:15:8d:49:43:1c:9d:2c:27:e2:a9:9c:b9:ea:41:84:b7:2c:b9:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4158d49431c9d2c27e2a99cb9ea4184b72cb9dd/; sid:903202860; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"b6:c0:21:1b:e4:e0:20:1d:2e:41:29:89:f7:ae:98:61:4c:d9:55:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6c0211be4e0201d2e412989f7ae98614cd9552f/; sid:903202861; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d1:a6:7e:96:26:98:f2:d8:62:10:a6:0d:b4:36:6f:d0:28:ae:f0:f3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1a67e962698f2d86210a60db4366fd028aef0f3/; sid:903202862; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"54:04:fc:7e:89:27:63:f1:6a:d1:10:8e:5c:ee:82:5a:5d:b6:fc:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5404fc7e892763f16ad1108e5cee825a5db6fc69/; sid:903202863; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"05:8e:72:36:08:c0:fb:2a:c0:1f:d1:f4:2e:cf:2b:03:c2:6a:f7:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/058e723608c0fb2ac01fd1f42ecf2b03c26af7ec/; sid:903202864; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ransomware.Nemty C&C)"; tls_cert_fingerprint; content:"d8:08:69:05:32:67:94:d0:e5:53:bd:6a:7a:d9:a0:64:98:b1:ce:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8086905326794d0e553bd6a7ad9a06498b1ce4d/; sid:903202865; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a4:1f:53:75:72:9b:32:73:b8:2a:5d:81:0f:ba:67:b4:c0:25:4b:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a41f5375729b3273b82a5d810fba67b4c0254b08/; sid:903202866; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d7:11:b3:4f:3a:6c:d9:ee:82:a6:76:99:18:3e:ae:e8:69:59:cb:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d711b34f3a6cd9ee82a67699183eaee86959cb3d/; sid:903202867; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ba:b5:68:47:4e:fe:17:dc:22:df:62:9f:43:4c:25:74:c8:ba:52:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bab568474efe17dc22df629f434c2574c8ba52d4/; sid:903202868; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"18:65:68:55:3a:81:a8:b3:fd:3e:33:2e:a3:36:a9:fc:e2:41:60:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/186568553a81a8b3fd3e332ea336a9fce24160f1/; sid:903202869; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e9:18:a5:6b:ea:e7:5a:eb:dc:7a:a1:4a:9e:78:2e:5d:1a:19:d7:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e918a56beae75aebdc7aa14a9e782e5d1a19d780/; sid:903202870; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f8:2e:93:d6:08:e6:a8:8c:95:36:0e:1b:92:75:f8:b5:a6:58:00:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f82e93d608e6a88c95360e1b9275f8b5a65800e0/; sid:903202871; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"11:6a:86:e0:c7:03:10:d1:35:22:1b:48:cd:fe:88:93:5a:3e:7a:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/116a86e0c70310d135221b48cdfe88935a3e7a49/; sid:903202872; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"71:f8:7d:11:e5:10:73:60:95:73:f5:91:fb:92:67:70:ef:45:07:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/71f87d11e51073609573f591fb926770ef450758/; sid:903202873; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d8:77:d1:3c:4d:a2:90:c0:90:5c:cb:94:a0:fd:dc:5e:33:63:3e:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d877d13c4da290c0905ccb94a0fddc5e33633ef9/; sid:903202874; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"22:79:50:9f:e8:3c:09:19:5f:bd:d5:12:09:49:70:1e:b5:22:43:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2279509fe83c09195fbdd5120949701eb5224371/; sid:903202875; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"78:82:1d:7f:7c:20:6b:c0:f9:22:6c:2d:9d:45:99:4c:83:2e:bd:a9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/78821d7f7c206bc0f9226c2d9d45994c832ebda9/; sid:903202876; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"94:a1:6d:3f:87:db:44:95:75:64:e9:8f:1b:2d:ab:9f:8f:f0:ec:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/94a16d3f87db44957564e98f1b2dab9f8ff0ec46/; sid:903202877; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TinyNuke C&C)"; tls_cert_fingerprint; content:"23:92:b4:19:6b:28:ba:ea:c7:94:43:74:b1:69:6d:55:63:18:77:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2392b4196b28baeac7944374b1696d55631877e7/; sid:903202878; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"c3:63:f3:0a:f6:02:1c:5b:f3:3e:31:b6:ef:4f:83:29:b6:cd:08:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c363f30af6021c5bf33e31b6ef4f8329b6cd0868/; sid:903202879; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"80:f6:f9:e3:19:05:07:c2:7f:b6:3f:74:48:5c:7e:3b:c0:6a:72:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80f6f9e3190507c27fb63f74485c7e3bc06a726a/; sid:903202880; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"08:6d:4c:63:83:2e:3a:07:20:f3:58:81:0f:80:c7:59:21:75:81:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/086d4c63832e3a0720f358810f80c759217581a6/; sid:903202881; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"08:eb:b0:03:d3:dd:a1:6b:c8:1d:7b:b2:f6:5b:2e:58:be:1a:b9:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/08ebb003d3dda16bc81d7bb2f65b2e58be1ab971/; sid:903202882; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"d5:d8:e4:8a:94:e1:ae:53:59:cd:e5:83:1e:bf:dd:36:b0:35:26:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d5d8e48a94e1ae5359cde5831ebfdd36b0352629/; sid:903202883; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b0:39:28:40:a4:4b:49:05:13:e4:79:44:92:0d:12:fa:8f:af:20:c4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0392840a44b490513e47944920d12fa8faf20c4/; sid:903202884; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"30:92:68:db:81:18:6f:49:14:bb:0c:08:c4:41:33:a6:95:2d:d6:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/309268db81186f4914bb0c08c44133a6952dd603/; sid:903202885; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"27:86:a5:a6:a6:62:fc:44:9b:25:58:81:1d:a6:41:78:0d:63:51:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2786a5a6a662fc449b2558811da641780d635113/; sid:903202886; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"51:9b:f0:66:84:eb:db:7e:51:72:bc:61:53:18:1d:9a:a8:5f:27:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/519bf06684ebdb7e5172bc6153181d9aa85f27cd/; sid:903202887; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2d:3a:ff:96:a0:a8:dc:98:01:5d:e8:1e:2d:cd:8b:7c:9b:92:d3:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2d3aff96a0a8dc98015de81e2dcd8b7c9b92d376/; sid:903202888; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"83:cf:65:96:16:c2:2b:7d:3d:ef:b0:57:75:d6:0a:ef:95:3e:e6:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/83cf659616c22b7d3defb05775d60aef953ee6ca/; sid:903202889; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"19:b1:9d:33:2a:6f:48:20:9e:e9:dd:51:0b:3f:e1:d2:17:8c:88:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19b19d332a6f48209ee9dd510b3fe1d2178c8806/; sid:903202890; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"47:3b:fc:a8:b7:e8:85:56:48:27:31:54:9a:be:b9:65:9a:a1:b8:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/473bfca8b7e88556482731549abeb9659aa1b8f8/; sid:903202891; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d7:ff:f5:48:76:76:b1:8d:ef:88:d8:3f:43:91:4f:d4:34:99:0c:0a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d7fff5487676b18def88d83f43914fd434990c0a/; sid:903202892; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"93:92:da:5f:2d:05:49:98:86:1e:88:a6:b8:0e:52:74:19:aa:38:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9392da5f2d054998861e88a6b80e527419aa384c/; sid:903202893; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"37:dc:ed:e9:3c:35:6b:1e:87:c9:59:4c:2f:f7:62:19:d1:7e:14:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/37dcede93c356b1e87c9594c2ff76219d17e14a6/; sid:903202894; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"c3:47:3f:7c:39:23:a5:33:02:5f:20:68:83:69:d9:f6:63:28:35:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c3473f7c3923a533025f20688369d9f663283594/; sid:903202895; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5c:87:38:46:24:ab:2b:04:c9:2f:b7:03:c6:44:6c:44:ab:5c:9e:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5c87384624ab2b04c92fb703c6446c44ab5c9ecd/; sid:903202896; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ostap C&C)"; tls_cert_fingerprint; content:"bb:56:e3:d9:b3:70:cf:f3:37:69:c1:18:12:e1:0f:e0:94:b3:18:00"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bb56e3d9b370cff33769c11812e10fe094b31800/; sid:903202897; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ostap C&C)"; tls_cert_fingerprint; content:"de:98:64:31:ff:37:f7:dc:bd:7c:70:13:aa:47:be:d4:f2:14:83:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de986431ff37f7dcbd7c7013aa47bed4f21483c3/; sid:903202898; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"fb:a3:fd:ed:74:31:cf:44:2f:6d:c0:e6:df:95:6c:7b:c6:63:bf:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fba3fded7431cf442f6dc0e6df956c7bc663bfed/; sid:903202899; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1c:ce:2d:93:40:3e:74:8a:7a:a1:75:51:1d:89:7e:2d:a6:f5:09:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1cce2d93403e748a7aa175511d897e2da6f50920/; sid:903202900; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5e:f5:f7:05:a9:a5:b2:97:cb:e5:fe:8e:41:2b:b7:58:2c:20:9b:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ef5f705a9a5b297cbe5fe8e412bb7582c209bfd/; sid:903202901; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ostap C&C)"; tls_cert_fingerprint; content:"74:86:ac:5b:2a:f4:44:13:00:36:97:96:8d:5c:2f:46:fa:a6:49:ca"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7486ac5b2af44413003697968d5c2f46faa649ca/; sid:903202902; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ostap C&C)"; tls_cert_fingerprint; content:"1b:61:d0:2d:82:0b:d7:11:08:7c:85:05:57:a8:1b:bf:af:53:24:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b61d02d820bd711087c850557a81bbfaf53246c/; sid:903202903; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c1:cd:0d:73:ac:78:05:18:21:a3:d8:2c:4a:1c:81:6d:57:f0:90:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1cd0d73ac78051821a3d82c4a1c816d57f0909d/; sid:903202904; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"8c:95:e6:7d:32:1e:82:9d:0a:40:eb:f5:64:59:76:17:c2:61:cc:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c95e67d321e829d0a40ebf564597617c261cc4c/; sid:903202905; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"3b:05:34:8b:3f:4d:e2:b8:33:cf:93:5a:6c:9e:03:a2:cb:7c:bd:e9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3b05348b3f4de2b833cf935a6c9e03a2cb7cbde9/; sid:903202906; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"7c:f9:02:ff:50:b3:86:9c:ca:a4:71:5b:25:bb:ea:3c:b1:8a:18:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7cf902ff50b3869ccaa4715b25bbea3cb18a18b5/; sid:903202907; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"ea:c4:ce:d3:59:ad:5f:02:8e:6f:89:44:06:9e:bb:97:77:bc:79:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eac4ced359ad5f028e6f8944069ebb9777bc79db/; sid:903202908; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"69:53:08:12:18:a0:bd:02:29:b1:b0:bf:63:97:37:8e:ad:06:60:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6953081218a0bd0229b1b0bf6397378ead0660cf/; sid:903202909; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Ostap C&C)"; tls_cert_fingerprint; content:"93:45:1c:ec:2f:b6:85:3f:bd:6f:b5:05:3b:ae:74:71:62:e0:fe:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/93451cec2fb6853fbd6fb5053bae747162e0feaf/; sid:903202910; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"52:b6:df:64:f9:2c:c9:53:79:36:5c:79:b2:27:cd:f6:fe:1f:ad:5d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52b6df64f92cc95379365c79b227cdf6fe1fad5d/; sid:903202911; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"9d:51:76:3b:a3:fd:4d:4f:b1:60:13:49:82:6f:0e:8a:58:45:22:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d51763ba3fd4d4fb1601349826f0e8a58452275/; sid:903202912; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"11:df:78:8f:84:13:86:01:eb:ca:db:ff:9f:fe:a9:02:cb:41:63:7e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/11df788f84138601ebcadbff9ffea902cb41637e/; sid:903202913; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"df:68:a8:78:f3:ea:a3:56:72:a3:ba:ed:6e:1b:d4:ff:b3:36:84:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/df68a878f3eaa35672a3baed6e1bd4ffb336842d/; sid:903202914; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"53:58:49:69:dc:1d:06:b9:15:3c:78:ef:29:84:6d:b0:45:7e:fa:87"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53584969dc1d06b9153c78ef29846db0457efa87/; sid:903202915; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"1f:62:8f:0b:2c:d0:ec:19:28:9d:ba:30:b3:0d:59:13:2f:df:1d:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f628f0b2cd0ec19289dba30b30d59132fdf1d18/; sid:903202916; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"2c:44:14:fa:fd:eb:e3:ea:c6:f6:2c:8c:77:58:f6:20:3b:cb:03:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c4414fafdebe3eac6f62c8c7758f6203bcb03ee/; sid:903202917; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"00:50:1d:89:a8:80:f6:3b:bf:9c:a4:79:32:b8:5b:8c:2a:1f:23:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00501d89a880f63bbf9ca47932b85b8c2a1f2373/; sid:903202918; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"2a:2b:4b:a8:e3:67:65:e6:ee:f4:46:15:21:db:6d:7a:67:9a:84:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2a2b4ba8e36765e6eef4461521db6d7a679a8409/; sid:903202919; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"30:3a:e8:65:54:dc:d9:55:11:74:db:8b:4b:ee:d8:2f:fa:50:ff:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/303ae86554dcd9551174db8b4beed82ffa50ff36/; sid:903202920; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"7a:a3:b9:35:85:b4:19:30:5a:c1:64:63:d0:3a:89:37:c8:86:f0:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7aa3b93585b419305ac16463d03a8937c886f0ee/; sid:903202921; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"0b:43:b1:f1:7f:c3:b4:8e:f0:7a:bd:df:6c:61:fe:16:05:d9:31:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b43b1f17fc3b48ef07abddf6c61fe1605d93121/; sid:903202922; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"50:2c:91:89:52:ce:c3:3e:f1:f0:30:94:f9:11:3c:70:e6:7d:4f:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/502c918952cec33ef1f03094f9113c70e67d4f1a/; sid:903202923; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e2:6e:60:3c:56:3b:41:ed:e2:9b:e1:b8:0a:5a:f0:8e:2a:59:96:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e26e603c563b41ede29be1b80a5af08e2a599627/; sid:903202924; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"69:8c:3c:d0:be:c7:a9:e0:f5:41:cf:b0:25:03:02:00:e0:4e:54:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/698c3cd0bec7a9e0f541cfb025030200e04e54a6/; sid:903202925; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"39:c4:83:c2:57:2f:69:65:93:3e:45:c9:7c:5e:5a:be:a1:a2:fc:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39c483c2572f6965933e45c97c5e5abea1a2fc35/; sid:903202926; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"27:b0:de:ea:c2:3c:90:ea:fa:a5:9a:41:0d:e5:e1:1f:3e:6c:4f:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/27b0deeac23c90eafaa59a410de5e11f3e6c4f17/; sid:903202927; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"b2:c6:71:31:3a:b3:0e:22:9c:f2:bf:12:b4:92:c5:dc:bb:ea:b5:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2c671313ab30e229cf2bf12b492c5dcbbeab591/; sid:903202928; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c7:34:40:bd:ea:2b:f8:eb:4c:3c:4a:3a:a9:5e:d3:9e:4f:e1:c8:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c73440bdea2bf8eb4c3c4a3aa95ed39e4fe1c8fa/; sid:903202929; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"64:4b:15:12:af:6f:bc:bb:3a:a4:cc:ee:4b:12:cb:ed:fe:4f:3c:f9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/644b1512af6fbcbb3aa4ccee4b12cbedfe4f3cf9/; sid:903202930; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"62:28:c3:9f:bc:97:54:4e:af:f5:34:ff:b4:cb:11:a2:c3:b9:8d:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6228c39fbc97544eaff534ffb4cb11a2c3b98d58/; sid:903202931; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"b6:ba:50:48:64:44:a1:6a:a6:02:bb:2e:f5:9d:6d:3e:87:2f:80:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6ba50486444a16aa602bb2ef59d6d3e872f80c9/; sid:903202932; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"53:e7:c3:c6:cd:35:5e:ab:07:f4:3b:18:a8:06:04:83:4f:4c:e5:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/53e7c3c6cd355eab07f43b18a80604834f4ce5fb/; sid:903202933; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"28:27:c4:10:ec:75:4e:24:2c:3c:8b:8f:ee:b9:bd:c4:86:81:2a:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2827c410ec754e242c3c8b8feeb9bdc486812a3b/; sid:903202934; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"20:8b:de:39:ff:57:b8:4f:63:ff:64:06:43:ae:17:e7:a0:c8:e3:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/208bde39ff57b84f63ff640643ae17e7a0c8e304/; sid:903202935; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"5c:e2:ba:0a:af:ba:41:6b:18:d5:ff:23:d5:c4:9a:94:1d:6d:a9:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ce2ba0aafba416b18d5ff23d5c49a941d6da9db/; sid:903202936; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CobInt C&C)"; tls_cert_fingerprint; content:"54:06:ec:e2:3c:12:68:54:8e:39:d2:83:88:c3:3c:e1:fc:4b:e3:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5406ece23c1268548e39d28388c33ce1fc4be310/; sid:903202937; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"28:09:6d:ef:de:6b:fa:8e:87:c9:07:7b:b8:3c:4f:2c:3e:6f:3d:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/28096defde6bfa8e87c9077bb83c4f2c3e6f3ded/; sid:903202938; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"c1:bd:a1:ea:8c:1f:4f:9e:ad:79:8d:74:95:a8:98:b3:d4:47:a7:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c1bda1ea8c1f4f9ead798d7495a898b3d447a771/; sid:903202939; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"01:9a:14:cb:ea:17:1a:cd:0f:80:0d:fa:50:5f:d0:d1:41:8c:87:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/019a14cbea171acd0f800dfa505fd0d1418c876c/; sid:903202940; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PsiXBot C&C)"; tls_cert_fingerprint; content:"41:e5:c1:47:58:3c:b7:e5:b5:d3:13:23:76:ae:f7:69:6d:53:dc:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/41e5c147583cb7e5b5d3132376aef7696d53dc35/; sid:903202941; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"5c:e2:2c:06:00:6a:86:af:4b:70:b9:77:20:2c:94:c2:5c:ed:6c:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5ce22c06006a86af4b70b977202c94c25ced6cc8/; sid:903202942; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"2e:9e:5d:5e:c3:be:fb:da:86:a3:21:31:d0:59:d8:7a:b5:e3:7e:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2e9e5d5ec3befbda86a32131d059d87ab5e37e8d/; sid:903202943; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"51:a4:05:e1:79:1e:14:af:11:20:83:87:34:8a:13:99:e6:e6:31:95"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/51a405e1791e14af11208387348a1399e6e63195/; sid:903202944; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PredatorStealer C&C)"; tls_cert_fingerprint; content:"dc:09:cf:47:d9:29:6e:75:cd:51:40:18:26:99:73:82:15:ec:e3:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc09cf47d9296e75cd5140182699738215ece3fe/; sid:903202945; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"66:3c:92:61:c6:50:2f:85:6e:26:07:51:09:6f:67:78:e1:b1:b0:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/663c9261c6502f856e260751096f6778e1b1b00d/; sid:903202946; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"50:6b:d9:7e:7e:d0:f9:75:8b:c5:44:c3:00:f7:22:73:2c:01:b4:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/506bd97e7ed0f9758bc544c300f722732c01b49f/; sid:903202947; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"c6:fe:66:a3:4a:6f:c3:41:1b:a7:6a:f8:01:0e:eb:d5:3b:f5:03:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6fe66a34a6fc3411ba76af8010eebd53bf5034f/; sid:903202948; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"97:53:06:e7:5e:de:7c:ad:22:80:74:db:0e:ed:4b:42:c6:bb:5f:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/975306e75ede7cad228074db0eed4b42c6bb5fb7/; sid:903202949; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"fe:98:96:aa:1f:bb:77:92:a2:a0:0d:e5:02:d4:97:14:16:32:ed:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fe9896aa1fbb7792a2a00de502d497141632ed80/; sid:903202950; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"73:2b:1b:65:8b:4a:87:8c:23:88:8f:61:3c:68:46:f1:b5:30:06:7b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/732b1b658b4a878c23888f613c6846f1b530067b/; sid:903202951; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CobInt C&C)"; tls_cert_fingerprint; content:"b4:b6:0b:4a:4a:7d:2f:ca:07:e2:68:59:e6:5c:4b:56:36:00:af:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4b60b4a4a7d2fca07e26859e65c4b563600af04/; sid:903202952; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"31:1a:67:f7:98:67:4c:c2:cf:94:6a:be:94:65:aa:f1:17:d6:44:ac"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/311a67f798674cc2cf946abe9465aaf117d644ac/; sid:903202953; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"aa:ab:6a:a3:05:aa:ae:a6:b0:83:c8:08:50:1a:f6:25:2e:41:91:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aaab6aa305aaaea6b083c808501af6252e41915a/; sid:903202954; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"56:b2:e4:2c:07:c9:26:6f:59:9b:57:b3:7f:4b:04:04:bc:e6:e9:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/56b2e42c07c9266f599b57b37f4b0404bce6e911/; sid:903202955; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"53:6d:b0:b0:6c:be:1c:92:f3:0d:81:7f:24:b6:46:cf:84:94:ce:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/536db0b06cbe1c92f30d817f24b646cf8494ce31/; sid:903202956; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a8:3b:24:59:41:cc:15:56:44:2e:0c:c3:de:6b:2e:dd:2b:36:4e:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a83b245941cc1556442e0cc3de6b2edd2b364ed7/; sid:903202957; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"7b:0e:12:41:de:d2:78:9e:6a:82:eb:fa:c3:a2:d6:d1:9a:44:30:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b0e1241ded2789e6a82ebfac3a2d6d19a44305b/; sid:903202958; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"c4:7e:db:00:55:a4:15:9e:45:68:37:b5:3c:c2:0f:72:7a:73:22:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c47edb0055a4159e456837b53cc20f727a7322e1/; sid:903202959; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"02:f7:8f:67:2f:41:0c:d3:12:3a:2f:7c:a0:15:87:02:dc:ef:7e:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02f78f672f410cd3123a2f7ca0158702dcef7e6a/; sid:903202960; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"20:02:39:a8:0d:d9:6c:66:74:1e:30:33:db:e2:43:a5:09:5e:39:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/200239a80dd96c66741e3033dbe243a5095e3979/; sid:903202961; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"45:44:f8:91:cb:3c:19:03:66:bc:5d:0d:33:1a:e1:7e:25:4b:26:e6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4544f891cb3c190366bc5d0d331ae17e254b26e6/; sid:903202962; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PredatorStealer C&C)"; tls_cert_fingerprint; content:"d8:ae:dd:31:da:f3:85:b5:38:25:5e:1f:a5:87:9e:19:19:db:64:b1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d8aedd31daf385b538255e1fa5879e1919db64b1/; sid:903202963; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"3c:14:e7:aa:18:06:1e:9a:dc:c7:80:44:c4:60:77:66:b4:a8:d0:c0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3c14e7aa18061e9adcc78044c4607766b4a8d0c0/; sid:903202964; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6c:c9:5d:cc:35:ca:96:32:6b:c7:89:34:98:4a:19:0f:09:e1:0d:03"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6cc95dcc35ca96326bc78934984a190f09e10d03/; sid:903202965; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"02:f3:bd:8a:37:54:b2:0f:1d:6e:b1:40:02:25:f3:23:0c:c4:d1:1f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/02f3bd8a3754b20f1d6eb1400225f3230cc4d11f/; sid:903202966; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"22:1d:03:5e:44:1c:0e:e3:59:5e:24:d3:e4:de:bd:ca:87:8d:0b:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/221d035e441c0ee3595e24d3e4debdca878d0bfb/; sid:903202967; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"43:17:d4:68:33:51:1a:21:7f:6f:0b:1c:c0:1d:ed:62:8c:af:fa:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4317d46833511a217f6f0b1cc01ded628caffa7a/; sid:903202968; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"29:99:b5:92:2e:98:85:90:85:3f:1a:d8:3c:08:32:2e:7b:b5:b2:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2999b5922e988590853f1ad83c08322e7bb5b2b0/; sid:903202969; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"40:8f:38:7e:3e:fe:fa:21:0c:b5:cc:e3:67:d4:40:d8:f8:88:a8:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/408f387e3efefa210cb5cce367d440d8f888a814/; sid:903202970; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"14:7a:2b:14:54:1b:2a:55:bb:cc:2a:79:cd:5e:19:76:ba:8c:e6:11"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/147a2b14541b2a55bbcc2a79cd5e1976ba8ce611/; sid:903202971; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"85:79:2a:f2:0e:1a:8d:e4:c1:5d:a9:cc:3a:b9:7a:64:96:ff:c8:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85792af20e1a8de4c15da9cc3ab97a6496ffc8a3/; sid:903202972; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"26:10:87:ae:80:29:e6:84:6d:f0:b2:46:17:a5:a0:43:89:b3:ba:45"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/261087ae8029e6846df0b24617a5a04389b3ba45/; sid:903202973; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"dd:44:2a:61:a3:79:08:de:83:0e:20:26:c2:62:59:40:c1:bc:c7:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd442a61a37908de830e2026c2625940c1bcc79a/; sid:903202974; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"59:61:5b:46:2f:9c:39:58:a9:be:ac:ba:c2:db:85:60:6d:6c:23:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59615b462f9c3958a9beacbac2db85606d6c2357/; sid:903202975; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"09:5b:d6:46:3c:d2:d1:f6:fb:08:80:e3:14:c6:51:bc:b6:ce:db:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/095bd6463cd2d1f6fb0880e314c651bcb6cedba6/; sid:903202976; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"f0:3e:d0:35:45:7b:c1:31:92:4f:77:a4:65:99:01:4f:af:c4:bc:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f03ed035457bc131924f77a46599014fafc4bc9d/; sid:903202977; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"51:79:ef:06:82:0b:d5:32:3b:5b:2b:1f:02:49:79:4c:d7:f2:5d:4e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5179ef06820bd5323b5b2b1f0249794cd7f25d4e/; sid:903202978; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"9e:d3:2c:f2:1c:a2:44:a7:85:da:6a:62:54:c2:a7:b8:f4:1e:61:53"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ed32cf21ca244a785da6a6254c2a7b8f41e6153/; sid:903202979; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PredatorStealer C&C)"; tls_cert_fingerprint; content:"ac:2f:cc:2c:6a:6f:d7:75:7e:24:f2:69:a8:f9:3f:21:87:f0:4a:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac2fcc2c6a6fd7757e24f269a8f93f2187f04a6e/; sid:903202980; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"23:8d:8b:89:fb:1d:48:57:7f:e7:2d:4b:fc:6a:bf:f8:34:83:35:8b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/238d8b89fb1d48577fe72d4bfc6abff83483358b/; sid:903202981; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"10:80:27:05:c6:5f:12:3e:98:97:97:bf:e0:ba:46:ba:33:b3:9d:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/10802705c65f123e989797bfe0ba46ba33b39d70/; sid:903202982; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"ac:bb:66:69:8b:5c:41:ea:5d:5a:7c:9c:7a:91:e9:79:03:80:00:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/acbb66698b5c41ea5d5a7c9c7a91e97903800031/; sid:903202983; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"4c:cb:e2:1d:74:a8:b2:06:6c:14:3e:18:39:0e:5b:c8:6c:4a:43:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4ccbe21d74a8b2066c143e18390e5bc86c4a4368/; sid:903202984; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"47:9d:98:c9:37:fa:9d:89:e7:6c:db:c2:76:d4:13:6c:bb:7e:2c:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/479d98c937fa9d89e76cdbc276d4136cbb7e2c8a/; sid:903202985; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e4:2c:e4:db:da:f0:34:4b:d7:34:db:f9:87:74:42:36:41:e4:8f:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e42ce4dbdaf0344bd734dbf98774423641e48f5a/; sid:903202986; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"72:f2:4c:a3:d5:65:83:a2:8c:c3:ec:90:ae:ff:6b:16:e2:2d:1e:ea"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/72f24ca3d56583a28cc3ec90aeff6b16e22d1eea/; sid:903202987; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"b6:c2:e9:2c:67:63:f0:d8:f5:ab:53:e7:f8:58:cf:c9:4c:05:c3:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b6c2e92c6763f0d8f5ab53e7f858cfc94c05c319/; sid:903202988; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"4d:c1:bd:19:a1:cc:3d:43:23:2e:ee:ea:1f:99:76:56:1e:a4:d2:15"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4dc1bd19a1cc3d43232eeeea1f9976561ea4d215/; sid:903202989; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"d1:10:b1:f8:e6:8a:e3:6b:c9:a8:e4:ef:71:8d:93:17:e5:d6:d5:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d110b1f8e68ae36bc9a8e4ef718d9317e5d6d54c/; sid:903202990; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"dc:97:fb:4b:f1:32:fc:0e:02:68:87:c1:66:4b:a1:57:27:5b:6f:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc97fb4bf132fc0e026887c1664ba157275b6fe4/; sid:903202991; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"06:87:1c:09:96:03:18:6c:a2:6b:9c:51:d5:9d:d7:89:f2:b3:68:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06871c099603186ca26b9c51d59dd789f2b3686b/; sid:903202992; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"85:c9:0c:84:64:37:43:d7:88:99:28:22:1f:ba:7e:a7:7b:5d:1a:5a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/85c90c84643743d7889928221fba7ea77b5d1a5a/; sid:903202993; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"da:54:72:c3:04:25:1f:99:b7:9d:94:4c:71:38:d7:51:3c:8d:d2:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da5472c304251f99b79d944c7138d7513c8dd264/; sid:903202994; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"1d:9c:0e:06:ae:5d:47:0d:d3:83:c3:5c:2f:1a:e0:df:46:77:f1:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1d9c0e06ae5d470dd383c35c2f1ae0df4677f16e/; sid:903202995; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"dc:9e:e1:57:94:1c:a7:f6:ef:e4:9c:2a:e6:4b:a9:51:4e:8a:e4:0d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc9ee157941ca7f6efe49c2ae64ba9514e8ae40d/; sid:903202996; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"17:57:dd:01:25:ca:88:a5:9c:56:b4:ea:84:42:21:87:e8:e4:2e:a6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1757dd0125ca88a59c56b4ea84422187e8e42ea6/; sid:903202997; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"0e:12:b2:db:c3:e8:99:2b:84:0c:fd:2f:fd:6b:ce:c3:8c:18:af:13"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0e12b2dbc3e8992b840cfd2ffd6bcec38c18af13/; sid:903202998; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"3a:ec:77:26:94:ed:6d:11:5a:82:d2:1f:a0:ca:8a:e4:bb:1f:2c:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3aec772694ed6d115a82d21fa0ca8ae4bb1f2c35/; sid:903202999; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"f0:a9:25:3d:e5:cb:31:fa:dc:1c:5f:2e:65:29:05:f5:02:27:e5:76"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0a9253de5cb31fadc1c5f2e652905f50227e576/; sid:903203000; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"eb:dc:eb:40:38:c9:48:1d:12:0e:2f:2c:f6:e6:fa:f2:02:eb:d1:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ebdceb4038c9481d120e2f2cf6e6faf202ebd1df/; sid:903203001; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"08:80:f2:e9:60:4f:d6:e1:ff:63:75:1b:64:48:06:51:71:cc:d4:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0880f2e9604fd6e1ff63751b6448065171ccd439/; sid:903203002; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"3a:3a:52:d0:14:bd:eb:3b:e6:da:ee:6d:ab:0f:c2:76:bb:c1:98:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a3a52d014bdeb3be6daee6dab0fc276bbc19867/; sid:903203003; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"b7:3f:50:53:99:a8:47:31:6d:e1:05:b8:c6:78:39:9f:37:a7:3a:66"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b73f505399a847316de105b8c678399f37a73a66/; sid:903203004; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"cf:bf:a6:72:45:15:b3:82:9c:c7:84:35:91:80:94:c8:6d:60:84:29"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cfbfa6724515b3829cc78435918094c86d608429/; sid:903203005; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"69:25:0d:36:91:c4:2a:53:70:8c:b5:82:ab:6c:1b:44:ef:94:a2:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/69250d3691c42a53708cb582ab6c1b44ef94a2fd/; sid:903203006; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"1f:ac:b1:de:1a:46:3d:e4:b6:d5:21:3c:7c:cd:62:83:5d:2b:6a:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1facb1de1a463de4b6d5213c7ccd62835d2b6a36/; sid:903203007; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"db:20:b7:39:72:0e:a6:0c:0d:11:0e:8a:2e:2a:08:77:3b:1d:5b:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/db20b739720ea60c0d110e8a2e2a08773b1d5b1d/; sid:903203008; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"dd:08:2f:01:b9:7f:6e:f1:69:96:25:07:23:6c:ee:42:83:49:83:16"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd082f01b97f6ef169962507236cee4283498316/; sid:903203009; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"21:b3:c9:01:e7:f0:1e:d6:59:0e:19:8a:d3:51:2c:b5:31:05:f0:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/21b3c901e7f01ed6590e198ad3512cb53105f018/; sid:903203010; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (TA505 C&C)"; tls_cert_fingerprint; content:"5f:4a:f8:75:f9:0b:39:d1:53:1b:f9:52:61:36:7e:bc:f8:fc:df:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f4af875f90b39d1531bf95261367ebcf8fcdfba/; sid:903203011; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ab:84:a1:e1:77:14:93:f5:64:6e:3b:d5:e5:d4:d9:cc:42:79:80:23"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab84a1e1771493f5646e3bd5e5d4d9cc42798023/; sid:903203012; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cd:56:f2:d6:56:89:a9:b3:c5:d1:ea:71:80:18:c4:d9:14:c2:ce:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd56f2d65689a9b3c5d1ea718018c4d914c2ced3/; sid:903203013; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"2c:8a:9b:e6:de:d4:ea:f8:64:bd:5c:1b:06:de:0d:c3:37:ba:ca:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c8a9be6ded4eaf864bd5c1b06de0dc337baca84/; sid:903203014; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"89:79:5b:38:4e:7e:f8:ed:70:12:3f:37:6d:4e:e1:36:0a:67:32:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89795b384e7ef8ed70123f376d4ee1360a673235/; sid:903203015; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"da:4c:0b:87:92:8e:be:31:0f:ac:27:74:43:fe:d9:78:f1:36:16:d7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/da4c0b87928ebe310fac277443fed978f13616d7/; sid:903203016; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"c2:28:17:61:69:b8:c5:83:6f:b6:3a:b1:44:17:ad:46:8b:bd:dc:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c228176169b8c5836fb63ab14417ad468bbddc26/; sid:903203017; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"2d:2e:5f:4d:60:47:4c:9e:3f:a6:84:ce:3d:3d:dd:3f:be:36:a3:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2d2e5f4d60474c9e3fa684ce3d3ddd3fbe36a351/; sid:903203018; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"db:bb:73:cf:1c:a8:79:29:c2:3b:9c:fb:8f:2c:ee:17:ec:91:0a:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dbbb73cf1ca87929c23b9cfb8f2cee17ec910ae3/; sid:903203019; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)"; tls_cert_fingerprint; content:"09:90:4c:da:16:b5:60:12:9e:70:39:d2:f7:48:2b:8e:ca:04:a1:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/09904cda16b560129e7039d2f7482b8eca04a19f/; sid:903203020; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"dc:53:a8:eb:e9:86:74:f5:97:4e:cd:10:ea:79:ed:9f:d0:40:df:43"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dc53a8ebe98674f5974ecd10ea79ed9fd040df43/; sid:903203021; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"38:9d:b7:a9:94:98:89:16:49:f3:fe:3e:38:14:61:2c:46:b6:7e:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/389db7a99498891649f3fe3e3814612c46b67e9f/; sid:903203022; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"ae:04:24:d2:37:03:82:13:99:89:ac:0f:12:26:8e:f8:86:ca:a2:ce"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ae0424d2370382139989ac0f12268ef886caa2ce/; sid:903203023; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"69:18:39:fb:ea:d7:0a:e9:fe:a3:14:83:73:dd:09:ae:65:51:4d:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/691839fbead70ae9fea3148373dd09ae65514d73/; sid:903203024; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"6f:13:e7:41:25:1c:10:7d:b3:29:4c:c4:d1:d8:e8:52:2c:4b:81:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6f13e741251c107db3294cc4d1d8e8522c4b810c/; sid:903203025; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"e3:4c:59:dd:e0:48:59:fb:3b:6a:37:85:7e:d2:53:50:1a:52:d2:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e34c59dde04859fb3b6a37857ed253501a52d288/; sid:903203026; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"51:c0:5b:bc:b0:ba:ae:64:81:37:0c:47:d6:c6:38:fd:e8:68:59:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/51c05bbcb0baae6481370c47d6c638fde8685925/; sid:903203027; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"76:08:08:03:96:c6:ed:01:d9:74:0b:f6:cb:48:89:1b:75:eb:38:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7608080396c6ed01d9740bf6cb48891b75eb3838/; sid:903203028; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"d9:94:42:3f:92:11:8b:75:52:12:75:40:90:c0:4f:c6:96:44:76:85"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d994423f92118b755212754090c04fc696447685/; sid:903203029; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"0b:64:77:99:3a:1b:5c:5c:b1:94:ed:72:18:5d:05:2d:61:20:6d:c5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0b6477993a1b5c5cb194ed72185d052d61206dc5/; sid:903203030; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"9d:1f:c9:0b:3a:11:ae:53:ec:56:63:9e:02:b6:fe:89:d0:48:a7:75"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d1fc90b3a11ae53ec56639e02b6fe89d048a775/; sid:903203031; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"fc:96:05:c4:95:76:ad:dc:f5:c9:ee:2f:5f:2b:46:d4:6d:83:c6:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fc9605c49576addcf5c9ee2f5f2b46d46d83c688/; sid:903203032; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"ff:2b:b0:f4:07:48:23:3a:18:6c:70:b3:ec:ad:cb:80:7d:66:0e:97"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ff2bb0f40748233a186c70b3ecadcb807d660e97/; sid:903203033; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"b6:9e:3b:cc:8e:51:e1:08:74:1f:15:26:a5:57:48:af:35:07:27:cf"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b69e3bcc8e51e108741f1526a55748af350727cf/; sid:903203034; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"9b:a7:96:f1:69:21:84:25:c8:f8:6a:98:92:80:2b:9b:1b:c7:03:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9ba796f169218425c8f86a9892802b9b1bc703ee/; sid:903203035; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cd:b0:cd:3b:9b:a7:71:e9:5c:69:64:37:25:3c:26:04:79:dc:4c:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cdb0cd3b9ba771e95c696437253c260479dc4cd3/; sid:903203036; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f3:96:ac:0e:e9:19:65:54:d7:8e:aa:c0:55:db:54:24:1c:88:2a:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f396ac0ee9196554d78eaac055db54241c882a6c/; sid:903203037; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"75:86:73:e3:0b:58:67:1f:f3:ad:1a:40:e2:39:2b:76:f0:31:db:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/758673e30b58671ff3ad1a40e2392b76f031dbc1/; sid:903203038; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"7b:af:03:31:6e:2b:a9:01:27:ff:3c:9b:da:a7:2f:57:1e:d8:96:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7baf03316e2ba90127ff3c9bdaa72f571ed896b0/; sid:903203039; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"59:fb:36:6e:b9:59:18:82:85:a8:c3:22:b5:4a:99:ed:3a:74:ed:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/59fb366eb959188285a8c322b54a99ed3a74ed8d/; sid:903203040; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f0:d7:ca:0b:90:d6:5d:b6:5b:85:da:cb:e6:26:7d:be:23:25:bd:f1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f0d7ca0b90d65db65b85dacbe6267dbe2325bdf1/; sid:903203041; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d6:15:c6:29:33:1e:e5:2a:ab:9a:e2:d1:2d:14:1b:7c:b3:d7:97:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d615c629331ee52aab9ae2d12d141b7cb3d797e0/; sid:903203042; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"88:89:59:65:65:d7:df:c6:68:bc:0e:fb:6e:22:dd:72:86:9b:06:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8889596565d7dfc668bc0efb6e22dd72869b06e7/; sid:903203043; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"9d:3d:77:b1:51:a1:71:0f:6b:16:05:23:64:e5:0c:ff:17:12:03:58"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9d3d77b151a1710f6b16052364e50cff17120358/; sid:903203044; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"cd:78:c1:8b:97:45:4e:69:3f:41:c3:e9:70:4c:b8:42:88:33:05:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd78c18b97454e693f41c3e9704cb8428833054f/; sid:903203045; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"45:39:35:d1:b1:91:a9:d0:d7:47:6a:5a:3a:c2:42:88:75:f1:bd:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/453935d1b191a9d0d7476a5a3ac2428875f1bd91/; sid:903203046; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e2:72:c0:00:25:b2:78:47:f2:e4:39:01:62:45:ec:3a:9e:8f:84:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e272c00025b27847f2e439016245ec3a9e8f844d/; sid:903203047; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"88:eb:b2:16:92:b2:ad:ad:dc:52:0c:e5:e7:b6:c4:74:90:7a:25:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/88ebb21692b2adaddc520ce5e7b6c474907a2504/; sid:903203048; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"fa:5e:c7:35:95:62:e2:d9:d4:91:70:ac:aa:10:d5:3d:e7:44:19:46"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa5ec7359562e2d9d49170acaa10d53de7441946/; sid:903203049; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"79:66:1a:64:20:d2:42:be:f7:34:13:97:63:e0:3d:53:79:7a:b6:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/79661a6420d242bef734139763e03d53797ab6fc/; sid:903203050; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d2:84:1f:be:cd:05:f9:3c:93:b7:a6:91:5e:d7:16:64:9b:ce:92:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d2841fbecd05f93c93b7a6915ed716649bce9264/; sid:903203051; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"28:32:ce:5b:1e:60:d7:7d:af:fd:96:3b:6f:6f:cc:4f:c2:f9:a3:9c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2832ce5b1e60d77daffd963b6f6fcc4fc2f9a39c/; sid:903203052; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"48:ad:ff:04:1d:35:a8:9c:c2:a9:df:5d:80:fd:65:79:c2:40:c8:b8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/48adff041d35a89cc2a9df5d80fd6579c240c8b8/; sid:903203053; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"24:d6:c9:af:c6:c8:99:1f:63:f8:42:cf:65:35:4d:46:14:9e:01:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/24d6c9afc6c8991f63f842cf65354d46149e01fa/; sid:903203054; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"06:fc:7f:f6:35:8b:b6:9a:a2:95:16:5a:d7:8f:22:f9:c5:70:0a:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/06fc7ff6358bb69aa295165ad78f22f9c5700aa0/; sid:903203055; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ac:5f:ad:f9:63:54:c7:dd:78:f5:47:3a:0a:27:38:7d:e9:b1:2d:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ac5fadf96354c7dd78f5473a0a27387de9b12d5e/; sid:903203056; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3a:42:59:57:b8:9d:51:04:8f:13:65:57:55:9a:cb:df:5f:95:a8:18"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3a425957b89d51048f136557559acbdf5f95a818/; sid:903203057; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"be:e3:3d:5a:9b:29:c0:29:38:b3:1c:f8:e8:ab:99:5c:4a:36:71:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bee33d5a9b29c02938b31cf8e8ab995c4a3671e1/; sid:903203058; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5f:1b:33:d7:61:4d:f1:32:36:52:37:0c:e6:a8:92:ce:72:d5:14:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f1b33d7614df1323652370ce6a892ce72d514f7/; sid:903203059; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"44:00:75:f2:65:0e:94:31:11:08:73:35:c9:20:02:c6:d6:da:20:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/440075f2650e943111087335c92002c6d6da20b7/; sid:903203060; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"31:96:0e:6e:70:fa:4e:d2:27:0a:55:42:b8:bb:3f:ec:98:4a:3a:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/31960e6e70fa4ed2270a5542b8bb3fec984a3a32/; sid:903203061; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"1d:f8:c7:cc:29:f0:6b:37:6f:35:35:91:d0:4f:94:a0:c2:3b:c5:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1df8c7cc29f06b376f353591d04f94a0c23bc5e3/; sid:903203062; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (FindPOS C&C)"; tls_cert_fingerprint; content:"25:cb:de:5d:ed:2a:6b:43:27:06:2e:8a:64:5c:a5:02:9e:7c:b7:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25cbde5ded2a6b4327062e8a645ca5029e7cb79d/; sid:903203063; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (KPOTStealer C&C)"; tls_cert_fingerprint; content:"7a:4d:12:17:95:8c:45:7b:a2:68:f6:cc:c0:d3:be:6a:70:34:57:51"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7a4d1217958c457ba268f6ccc0d3be6a70345751/; sid:903203064; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BlueBot C&C)"; tls_cert_fingerprint; content:"49:89:34:34:5c:f3:5b:fb:00:83:d3:ed:7f:64:db:39:39:b8:a8:39"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/498934345cf35bfb0083d3ed7f64db3939b8a839/; sid:903203065; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"05:e7:04:d1:ec:2a:e8:54:3e:12:b0:d4:92:b8:a5:f2:b9:31:af:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/05e704d1ec2ae8543e12b0d492b8a5f2b931af38/; sid:903203066; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f9:9e:33:b9:12:b9:73:3d:99:16:4d:36:9c:68:dd:76:c1:c7:d2:48"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f99e33b912b9733d99164d369c68dd76c1c7d248/; sid:903203067; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e8:af:d1:1a:9f:68:e0:37:f4:81:11:61:23:db:53:20:a5:ce:f8:84"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8afd11a9f68e037f481116123db5320a5cef884/; sid:903203068; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"48:82:87:ca:d1:0b:68:0d:d3:ab:4b:41:6b:8f:b0:a2:6a:fa:67:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/488287cad10b680dd3ab4b416b8fb0a26afa67c9/; sid:903203069; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"80:e3:8f:4f:18:28:2b:4c:6e:e0:c6:65:8e:a7:9b:c0:f2:5d:84:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/80e38f4f18282b4c6ee0c6658ea79bc0f25d84db/; sid:903203070; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"3e:8b:07:8b:c4:7e:ec:1a:74:d1:d3:0c:f6:dd:a7:44:af:d5:87:83"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3e8b078bc47eec1a74d1d30cf6dda744afd58783/; sid:903203071; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ea:fd:09:fc:5b:dc:36:76:67:6f:6a:0c:ee:d1:91:90:ad:18:49:7c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eafd09fc5bdc3676676f6a0ceed19190ad18497c/; sid:903203072; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ca:9d:37:39:ef:a5:75:e4:27:1a:47:ce:7f:12:b7:32:51:d6:1a:21"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ca9d3739efa575e4271a47ce7f12b73251d61a21/; sid:903203073; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"ec:f0:bd:4a:55:d1:34:3c:e7:1f:55:ed:5e:46:bf:6a:fa:08:18:5f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ecf0bd4a55d1343ce71f55ed5e46bf6afa08185f/; sid:903203074; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"38:d2:8a:d2:bc:28:56:54:c7:be:d8:3a:7e:2b:0d:eb:ef:0e:b7:91"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/38d28ad2bc285654c7bed83a7e2b0debef0eb791/; sid:903203075; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e9:fe:e6:69:8c:79:1c:33:fa:36:d1:a8:da:3e:80:73:c1:2f:a6:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e9fee6698c791c33fa36d1a8da3e8073c12fa6da/; sid:903203076; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"30:39:3a:46:86:c7:32:eb:de:f6:0e:3a:2a:b4:2b:b2:7f:73:b3:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30393a4686c732ebdef60e3a2ab42bb27f73b363/; sid:903203077; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"b5:aa:4d:d3:80:99:be:1c:e3:c9:e3:de:7f:ad:e8:c8:1a:65:13:54"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b5aa4dd38099be1ce3c9e3de7fade8c81a651354/; sid:903203078; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"01:2d:14:0b:f8:1b:0f:b8:e0:b7:71:fd:37:b1:05:35:77:05:68:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/012d140bf81b0fb8e0b771fd37b105357705686a/; sid:903203079; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"35:30:8e:ea:e2:55:b7:d8:c5:53:88:84:60:82:1c:76:18:1b:85:63"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35308eeae255b7d8c553888460821c76181b8563/; sid:903203080; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"93:2b:da:3c:73:f8:be:1d:c5:4b:cc:57:bc:55:fc:72:5e:55:44:e7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/932bda3c73f8be1dc54bcc57bc55fc725e5544e7/; sid:903203081; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"c6:07:36:30:d4:9a:7e:3a:5c:45:ac:ad:e6:e5:0e:e5:a1:57:19:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6073630d49a7e3a5c45acade6e50ee5a1571944/; sid:903203082; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"19:60:a5:92:cd:34:6a:93:4f:82:8c:7b:1d:a1:7d:e1:75:ba:59:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1960a592cd346a934f828c7b1da17de175ba59d4/; sid:903203083; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"25:5f:66:4c:2f:3a:8e:8e:21:6d:96:59:b3:e7:30:65:7d:85:3b:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/255f664c2f3a8e8e216d9659b3e730657d853b14/; sid:903203084; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"1b:2c:eb:32:ec:9c:55:27:dd:38:ad:5f:dc:ba:c4:85:b1:dc:6a:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1b2ceb32ec9c5527dd38ad5fdcbac485b1dc6afc/; sid:903203085; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"fd:8a:a2:d4:e1:c4:ea:68:5f:04:66:b5:0f:c6:ef:d4:c1:cc:2d:eb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd8aa2d4e1c4ea685f0466b50fc6efd4c1cc2deb/; sid:903203086; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"cd:88:cc:0a:59:86:99:a7:81:86:4b:de:f1:8f:50:da:b0:6f:81:8d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cd88cc0a598699a781864bdef18f50dab06f818d/; sid:903203087; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5f:62:3f:b2:13:f6:8f:95:fe:6a:c5:3c:93:c8:bf:da:dc:31:95:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5f623fb213f68f95fe6ac53c93c8bfdadc3195c1/; sid:903203088; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"35:35:b6:16:a0:08:41:9a:52:3c:eb:d5:05:af:91:19:b4:a1:bd:49"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3535b616a008419a523cebd505af9119b4a1bd49/; sid:903203089; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"d9:96:af:9a:b6:c5:90:a2:7a:73:35:8d:df:37:7a:dd:5b:f8:c0:5e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d996af9ab6c590a27a73358ddf377add5bf8c05e/; sid:903203090; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"a3:d5:54:82:a8:e9:03:7d:9b:ee:bb:4e:1e:6b:24:5e:ef:5e:95:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a3d55482a8e9037d9beebb4e1e6b245eef5e9594/; sid:903203091; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f7:1b:35:5e:d8:21:a8:50:85:24:67:20:a4:15:ce:7e:b0:60:c3:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f71b355ed821a85085246720a415ce7eb060c388/; sid:903203092; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f9:3d:b0:8a:b8:40:ec:dd:62:39:e3:3c:56:5f:5b:78:c3:ea:e9:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f93db08ab840ecdd6239e33c565f5b78c3eae9c8/; sid:903203093; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"84:f2:4e:c9:f4:0f:e8:65:c8:fa:d7:eb:7d:7c:89:71:82:8f:ca:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84f24ec9f40fe865c8fad7eb7d7c8971828fcae1/; sid:903203094; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (DanaBot C&C)"; tls_cert_fingerprint; content:"98:55:23:60:7f:59:4e:fc:15:5b:64:22:90:88:cd:ae:c7:79:b3:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/985523607f594efc155b64229088cdaec779b317/; sid:903203095; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"35:fc:ae:f2:ea:a6:d3:ad:df:86:74:5c:59:c1:c1:2b:08:21:29:60"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/35fcaef2eaa6d3addf86745c59c1c12b08212960/; sid:903203096; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"8f:f4:f4:e0:82:f6:20:6b:eb:d7:09:4c:76:20:3a:38:7d:aa:7d:7f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8ff4f4e082f6206bebd7094c76203a387daa7d7f/; sid:903203097; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d5:10:f1:21:2e:bf:e3:21:a4:70:13:94:1f:d9:81:4e:73:16:f9:e2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d510f1212ebfe321a47013941fd9814e7316f9e2/; sid:903203098; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"fc:f8:ef:46:c2:4d:ee:5c:d4:48:24:65:e5:a2:df:bf:20:26:78:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fcf8ef46c24dee5cd4482465e5a2dfbf20267808/; sid:903203099; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"83:9f:4f:ae:14:ec:31:19:d5:12:8f:5d:e8:2d:00:0a:1c:0e:6d:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/839f4fae14ec3119d5128f5de82d000a1c0e6d1d/; sid:903203100; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a0:be:43:66:2c:34:c6:f0:fe:99:73:02:83:61:3a:d5:36:99:a5:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a0be43662c34c6f0fe99730283613ad53699a5b5/; sid:903203101; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"3d:d4:b6:10:ff:09:31:00:31:3c:a7:db:e2:4f:06:2c:a8:0a:d6:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3dd4b610ff093100313ca7dbe24f062ca80ad6e1/; sid:903203102; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"5f:d1:16:bc:f7:92:17:4f:f8:43:3b:84:32:b5:77:d3:f3:8d:ab:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fd116bcf792174ff8433b8432b577d3f38dabd9/; sid:903203103; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f9:6d:5a:a2:bc:ee:a3:e4:3c:00:bb:45:aa:1a:b1:48:be:b4:5b:09"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f96d5aa2bceea3e43c00bb45aa1ab148beb45b09/; sid:903203104; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Loki C&C)"; tls_cert_fingerprint; content:"f1:4a:78:59:61:f8:55:f5:d0:80:2c:5f:20:42:9a:84:8f:36:ac:ee"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f14a785961f855f5d0802c5f20429a848f36acee/; sid:903203105; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"1a:87:61:28:e6:63:0d:6a:04:31:ef:91:2f:6a:d1:2a:08:4d:8e:26"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a876128e6630d6a0431ef912f6ad12a084d8e26/; sid:903203106; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"84:de:1f:d3:3d:95:40:77:84:d0:b3:77:3e:49:d9:5d:96:b2:a0:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84de1fd33d95407784d0b3773e49d95d96b2a0a3/; sid:903203107; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"7a:f1:e6:1f:e7:2a:16:25:f9:ec:0b:aa:f5:0f:86:ea:00:ae:83:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7af1e61fe72a1625f9ec0baaf50f86ea00ae8356/; sid:903203108; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"42:e1:0c:df:46:f9:9d:2b:42:dc:c2:c3:5f:71:25:49:15:de:e1:56"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/42e10cdf46f99d2b42dcc2c35f71254915dee156/; sid:903203109; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"3d:cf:2a:17:ae:cd:0a:f2:67:f9:8e:e5:ef:b6:fc:73:9c:80:b8:4d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3dcf2a17aecd0af267f98ee5efb6fc739c80b84d/; sid:903203110; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"95:f1:55:21:e6:37:f0:5a:57:93:22:6b:68:f9:0e:3b:62:3f:0d:64"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95f15521e637f05a5793226b68f90e3b623f0d64/; sid:903203111; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"97:7a:d4:55:90:3f:76:6e:8b:6f:92:95:c9:19:1a:a2:4e:4f:ef:9a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/977ad455903f766e8b6f9295c9191aa24e4fef9a/; sid:903203112; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"7b:88:36:5a:eb:50:8b:48:83:da:fd:96:30:6c:70:95:34:45:55:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b88365aeb508b4883dafd96306c7095344555a3/; sid:903203113; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"c5:10:e8:de:bb:f9:58:55:be:7c:5d:ec:eb:ac:2a:8c:3b:0b:2b:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c510e8debbf95855be7c5decebac2a8c3b0b2bcd/; sid:903203114; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"3e:c2:49:84:83:f9:40:60:4a:30:66:6d:f9:40:86:21:65:43:01:7a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/3ec2498483f940604a30666df94086216543017a/; sid:903203115; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"ed:a1:c1:28:8c:ea:6b:37:2a:b4:8f:92:a6:c7:fa:d7:82:f6:4e:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eda1c1288cea6b372ab48f92a6c7fad782f64e50/; sid:903203116; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"15:bc:80:0a:09:76:f2:fa:a4:f2:a8:a2:57:41:ba:72:1c:0d:64:e0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15bc800a0976f2faa4f2a8a25741ba721c0d64e0/; sid:903203117; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"ab:31:5c:68:7a:15:3e:56:b0:31:ea:c2:44:9e:c1:46:b7:22:21:d1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab315c687a153e56b031eac2449ec146b72221d1/; sid:903203118; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"20:75:62:21:56:ef:e6:14:90:38:8a:aa:95:e5:62:86:d5:ab:c4:2a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2075622156efe61490388aaa95e56286d5abc42a/; sid:903203119; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"83:21:71:b1:08:d6:f9:e2:a0:a9:d4:53:3e:1c:6a:cc:fb:ba:80:72"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/832171b108d6f9e2a0a9d4533e1c6accfbba8072/; sid:903203120; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"60:10:01:8e:50:5e:1f:c3:1f:96:ae:a5:02:2b:fa:9f:eb:d2:9c:14"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6010018e505e1fc31f96aea5022bfa9febd29c14/; sid:903203121; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"20:ec:8a:d2:08:df:3a:d4:ed:a2:9e:32:9d:0f:9f:0b:fd:1f:54:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20ec8ad208df3ad4eda29e329d0f9f0bfd1f5479/; sid:903203122; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (PredatorStealer C&C)"; tls_cert_fingerprint; content:"ed:d6:ac:43:eb:c2:44:9f:0c:31:8c:4b:49:e0:e1:78:6e:d8:01:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/edd6ac43ebc2449f0c318c4b49e0e1786ed801c8/; sid:903203123; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"a8:2e:6d:70:fd:4e:25:df:80:ea:0c:69:a6:f3:1b:d5:02:ab:89:04"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a82e6d70fd4e25df80ea0c69a6f31bd502ab8904/; sid:903203124; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"00:95:7e:ee:82:55:63:1a:04:de:ef:57:9b:1c:ca:9c:39:5f:e9:10"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/00957eee8255631a04deef579b1cca9c395fe910/; sid:903203125; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"15:18:2a:b8:43:2f:cd:20:ac:10:a1:58:2b:4b:96:27:f9:71:65:8f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/15182ab8432fcd20ac10a1582b4b9627f971658f/; sid:903203126; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ab:87:1d:a0:1c:cb:96:e4:8e:d3:63:45:18:55:62:62:f5:b7:35:ae"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ab871da01ccb96e48ed3634518556262f5b735ae/; sid:903203127; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"81:0a:a4:8d:49:e5:7d:8e:47:cc:c0:78:46:e3:ca:88:c5:7e:36:0c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/810aa48d49e57d8e47ccc07846e3ca88c57e360c/; sid:903203128; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"30:d3:e1:d4:14:c3:0d:1e:a3:40:09:f7:06:ff:e0:98:da:7d:01:d3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/30d3e1d414c30d1ea34009f706ffe098da7d01d3/; sid:903203129; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"bd:a4:a5:99:7f:23:20:09:c2:12:7b:c2:40:79:eb:de:71:5e:91:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bda4a5997f232009c2127bc24079ebde715e91bd/; sid:903203130; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"cb:1e:bc:b2:68:4b:2c:12:7f:67:31:9b:11:17:ae:39:e7:65:b1:b7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cb1ebcb2684b2c127f67319b1117ae39e765b1b7/; sid:903203131; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"4e:74:83:6a:fe:9e:ec:15:4e:68:39:d3:d0:54:54:e2:55:fe:e2:a3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4e74836afe9eec154e6839d3d05454e255fee2a3/; sid:903203132; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"4a:90:b8:95:6d:73:dc:5d:1a:2f:c8:63:3f:6b:b4:8c:e9:23:90:68"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4a90b8956d73dc5d1a2fc8633f6bb48ce9239068/; sid:903203133; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"46:07:3f:8b:c2:f9:94:bb:8f:79:31:f1:54:91:8e:1a:20:0c:d5:2d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/46073f8bc2f994bb8f7931f154918e1a200cd52d/; sid:903203134; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"46:81:f0:e7:e7:b6:ea:90:cd:ea:22:23:ca:9c:d7:01:66:b0:46:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4681f0e7e7b6ea90cdea2223ca9cd70166b046a1/; sid:903203135; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"6b:98:9a:d3:18:44:a8:9c:4c:ef:09:49:83:cf:a6:7a:c0:4e:ed:37"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6b989ad31844a89c4cef094983cfa67ac04eed37/; sid:903203136; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"81:35:29:39:1d:64:37:65:ec:6b:a5:51:67:a9:5a:36:17:10:30:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/813529391d643765ec6ba55167a95a36171030fc/; sid:903203137; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"9c:f4:86:c4:e0:96:6c:63:68:55:8b:8a:1f:dd:b6:9d:ea:27:da:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9cf486c4e0966c6368558b8a1fddb69dea27daf4/; sid:903203138; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"87:eb:3e:4d:61:8b:9a:54:ea:d2:36:3e:0f:d2:07:f6:74:89:89:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87eb3e4d618b9a54ead2363e0fd207f674898965/; sid:903203139; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"ce:ef:f1:60:54:54:fa:d0:64:68:33:35:f9:e9:0f:69:60:21:f3:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ceeff1605454fad064683335f9e90f696021f331/; sid:903203140; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"7b:02:22:85:51:4f:71:07:04:ea:14:69:13:f0:fc:75:5a:53:b1:f0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7b022285514f710704ea146913f0fc755a53b1f0/; sid:903203141; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"87:0e:01:c6:7a:a2:23:6f:12:7c:8d:78:eb:f6:e5:f1:39:3a:a2:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/870e01c67aa2236f127c8d78ebf6e5f1393aa257/; sid:903203142; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8f:6b:f7:cb:cf:01:4b:ee:0a:42:ec:65:2b:c9:6a:2f:a9:8a:ee:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f6bf7cbcf014bee0a42ec652bc96a2fa98aee36/; sid:903203143; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"86:d7:71:37:92:bf:d1:ee:51:61:5c:80:8b:8b:d6:92:0a:05:30:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/86d7713792bfd1ee51615c808b8bd6920a0530af/; sid:903203144; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"b9:46:7c:ee:53:2f:c0:a8:25:f9:37:7a:58:2d:8b:fe:43:17:ce:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b9467cee532fc0a825f9377a582d8bfe4317ce93/; sid:903203145; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"2f:cd:3c:ac:db:38:7d:ee:75:62:36:f6:c7:b7:99:37:78:7d:0c:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2fcd3cacdb387dee756236f6c7b79937787d0ce5/; sid:903203146; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"f5:f8:39:a5:a9:3a:49:c8:97:02:4a:25:b6:e4:13:df:00:6d:88:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f5f839a5a93a49c897024a25b6e413df006d88cb/; sid:903203147; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"50:39:c2:e2:95:8a:26:39:3e:50:03:7f:ac:04:46:c5:24:8f:7f:88"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5039c2e2958a26393e50037fac0446c5248f7f88/; sid:903203148; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"79:2c:f0:af:e3:7d:b0:99:d9:8d:3e:c9:52:37:49:42:4e:0f:fd:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/792cf0afe37db099d98d3ec9523749424e0ffdd4/; sid:903203149; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"76:9c:f6:e5:14:4e:a7:dd:ab:c4:c2:1f:1f:ba:69:61:92:7e:2e:a8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/769cf6e5144ea7ddabc4c21f1fba6961927e2ea8/; sid:903203150; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"ea:cc:28:7e:57:7d:b9:9e:61:04:32:cb:cc:87:59:79:79:31:05:36"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eacc287e577db99e610432cbcc87597979310536/; sid:903203151; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"44:ac:70:dc:37:af:67:cf:18:46:0e:6e:bd:04:b9:58:16:24:ce:4a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44ac70dc37af67cf18460e6ebd04b9581624ce4a/; sid:903203152; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"c2:b6:70:4d:1a:2d:2f:34:98:44:fe:10:c3:82:62:11:4b:87:94:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c2b6704d1a2d2f349844fe10c38262114b879473/; sid:903203153; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"69:2d:ad:49:76:89:75:f1:e3:20:e1:45:a3:14:0b:92:7d:31:c2:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/692dad49768975f1e320e145a3140b927d31c2a1/; sid:903203154; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BuerLoader C&C)"; tls_cert_fingerprint; content:"39:b1:49:a6:69:a5:0b:67:94:0d:da:a3:58:8a:8b:13:4f:e5:52:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/39b149a669a50b67940ddaa3588a8b134fe552e8/; sid:903203155; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"6d:a8:9e:aa:62:a7:f1:2d:c6:a3:d0:ef:4c:07:49:38:d5:60:f1:4f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6da89eaa62a7f12dc6a3d0ef4c074938d560f14f/; sid:903203156; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8b:ca:5f:91:82:5d:0d:b7:96:56:52:bd:16:c2:31:70:72:7b:68:c8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8bca5f91825d0db7965652bd16c23170727b68c8/; sid:903203157; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a6:9d:3b:36:59:04:9a:dd:79:86:2c:54:e0:96:43:b0:13:60:16:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a69d3b3659049add79862c54e09643b013601669/; sid:903203158; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"52:db:97:a8:0c:dc:42:b4:24:cd:84:2f:1b:2f:c0:3c:8c:ee:66:d9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/52db97a80cdc42b424cd842f1b2fc03c8cee66d9/; sid:903203159; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"af:f7:e8:66:dd:ef:40:f6:29:13:69:51:31:be:ad:1a:55:e7:ce:34"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/aff7e866ddef40f62913695131bead1a55e7ce34/; sid:903203160; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"07:c6:fc:9d:40:31:32:47:f8:7b:18:e0:b2:60:f3:e5:7f:c1:c5:25"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/07c6fc9d40313247f87b18e0b260f3e57fc1c525/; sid:903203161; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"e3:cc:23:ba:7f:b9:b1:cc:67:6b:c6:d7:19:b8:6c:78:7c:1b:06:d5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e3cc23ba7fb9b1cc676bc6d719b86c787c1b06d5/; sid:903203162; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BuerLoader C&C)"; tls_cert_fingerprint; content:"68:a5:06:44:7d:7c:0e:82:9a:8c:e8:32:88:6e:b4:6f:70:b4:4a:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68a506447d7c0e829a8ce832886eb46f70b44afe/; sid:903203163; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"23:18:2c:4e:27:c1:fb:9a:09:e2:22:c4:c9:46:46:53:7d:10:b3:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/23182c4e27c1fb9a09e222c4c94646537d10b3d4/; sid:903203164; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BuerLoader C&C)"; tls_cert_fingerprint; content:"99:ef:3d:6a:22:a0:ae:44:1b:97:2e:13:fc:3f:c9:35:c5:30:d3:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99ef3d6a22a0ae441b972e13fc3fc935c530d305/; sid:903203165; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"9f:12:91:2f:9b:c3:41:9e:06:70:a7:29:f9:c4:c1:6e:d8:fb:43:fa"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9f12912f9bc3419e0670a729f9c4c16ed8fb43fa/; sid:903203166; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"70:02:7f:40:af:91:b7:cf:5f:77:c0:d9:04:9e:8b:b2:49:f2:b8:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/70027f40af91b7cf5f77c0d9049e8bb249f2b81e/; sid:903203167; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BazaLoader C&C)"; tls_cert_fingerprint; content:"84:fa:28:bc:4a:69:56:1a:09:fd:1c:41:9c:5b:ea:68:7a:7d:a5:8a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84fa28bc4a69561a09fd1c419c5bea687a7da58a/; sid:903203168; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"20:37:3e:4d:4d:11:ba:0e:83:93:78:73:7e:e9:fc:49:cb:16:4b:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/20373e4d4d11ba0e839378737ee9fc49cb164bbd/; sid:903203169; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"86:44:71:15:45:fc:8d:1b:a0:2f:d4:e4:42:42:90:a0:68:15:c3:20"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8644711545fc8d1ba02fd4e4424290a06815c320/; sid:903203170; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"e5:d4:9e:0b:12:01:2e:40:49:8c:c9:91:ae:58:6b:3c:e0:5b:f2:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e5d49e0b12012e40498cc991ae586b3ce05bf2f6/; sid:903203171; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"19:cf:21:e6:32:6b:61:25:b0:23:c5:3d:f2:3b:74:06:0f:4e:78:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/19cf21e6326b6125b023c53df23b74060f4e786e/; sid:903203172; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"08:1c:f5:0a:56:f5:9b:e9:b1:f9:50:48:58:a2:25:b8:0f:23:3c:b2"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/081cf50a56f59be9b1f9504858a225b80f233cb2/; sid:903203173; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"65:39:0d:83:44:f3:82:e2:95:d8:a8:9d:f6:d8:6a:98:c4:58:8e:db"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/65390d8344f382e295d8a89df6d86a98c4588edb/; sid:903203174; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"b4:43:0a:3e:29:13:a5:67:05:4b:c8:cf:62:4a:f0:c4:2b:13:a9:fd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b4430a3e2913a567054bc8cf624af0c42b13a9fd/; sid:903203175; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"41:05:81:1b:72:d6:ff:fc:f4:29:84:a5:bd:0c:0b:5a:e2:13:cb:ec"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/4105811b72d6fffcf42984a5bd0c0b5ae213cbec/; sid:903203176; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"1a:82:3c:07:cd:b4:6e:c9:42:d7:91:ec:94:99:76:42:80:c2:cd:bb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a823c07cdb46ec942d791ec9499764280c2cdbb/; sid:903203177; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (RevengeRAT C&C)"; tls_cert_fingerprint; content:"74:9b:34:da:4a:c8:9c:bb:e6:4c:f3:80:5f:98:16:16:25:7f:b8:5b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/749b34da4ac89cbbe64cf3805f981616257fb85b/; sid:903203178; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"34:a1:63:99:8d:af:24:8a:58:ae:f5:40:47:00:7d:f6:a3:5e:af:55"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/34a163998daf248a58aef54047007df6a35eaf55/; sid:903203179; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8f:3d:ae:90:fa:f0:f9:a4:70:61:11:17:d9:c6:cb:3d:df:3e:64:e3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8f3dae90faf0f9a470611117d9c6cb3ddf3e64e3/; sid:903203180; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"dd:38:f4:45:87:45:16:92:9c:53:1f:f4:22:25:48:ba:1d:f4:e5:cb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd38f445874516929c531ff4222548ba1df4e5cb/; sid:903203181; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"08:68:cd:5f:13:80:f6:a7:68:8c:b6:5f:6e:e3:69:4f:83:c6:88:06"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0868cd5f1380f6a7688cb65f6ee3694f83c68806/; sid:903203182; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"fa:30:aa:ba:52:30:37:79:78:45:5b:b7:27:94:68:5e:a4:fc:ed:ba"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fa30aaba5230377978455bb72794685ea4fcedba/; sid:903203183; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"b5:16:cf:a2:67:3a:c7:d5:ff:05:5a:e2:cb:23:1a:78:1e:39:47:f6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b516cfa2673ac7d5ff055ae2cb231a781e3947f6/; sid:903203184; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5b:82:f4:50:82:30:9b:45:5d:50:a2:fe:8a:34:6d:87:f9:85:8a:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5b82f45082309b455d50a2fe8a346d87f9858adf/; sid:903203185; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BuerLoader C&C)"; tls_cert_fingerprint; content:"03:c6:32:b6:eb:7d:a7:e4:6e:e1:97:e9:c6:c4:1f:81:e0:d7:d4:cd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/03c632b6eb7da7e46ee197e9c6c41f81e0d7d4cd/; sid:903203186; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"23:51:fc:81:1f:3b:b2:77:d9:17:02:e8:58:19:91:c9:2f:6c:03:6c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2351fc811f3bb277d91702e8581991c92f6c036c/; sid:903203187; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"bc:97:aa:49:4f:e0:2b:5f:f2:93:ec:69:cb:dc:1a:25:b5:5e:35:f4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/bc97aa494fe02b5ff293ec69cbdc1a25b55e35f4/; sid:903203188; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"08:48:b6:51:c0:b5:45:47:d8:9d:98:31:2e:00:54:fb:84:41:cf:fc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0848b651c0b54547d89d98312e0054fb8441cffc/; sid:903203189; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"26:f0:65:74:9a:bc:56:8d:f0:a7:13:aa:c4:50:7f:9a:40:48:f0:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/26f065749abc568df0a713aac4507f9a4048f0e4/; sid:903203190; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"05:5f:7f:b8:2e:25:a2:b4:a7:f7:1e:d6:56:bc:5a:c2:7f:29:ef:fe"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/055f7fb82e25a2b4a7f71ed656bc5ac27f29effe/; sid:903203191; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5f:e1:db:57:77:40:5c:41:ef:f2:ad:91:40:bb:f2:ce:31:31:5e:c6"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5fe1db5777405c41eff2ad9140bbf2ce31315ec6/; sid:903203192; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8e:0e:60:4a:c6:12:cc:ed:e3:94:61:d0:05:da:57:ce:0b:2d:b3:2f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8e0e604ac612ccede39461d005da57ce0b2db32f/; sid:903203193; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"79:98:73:89:7b:db:cc:ae:a0:ee:ed:b9:df:13:ce:a9:38:7b:90:6f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/799873897bdbccaea0eeedb9df13cea9387b906f/; sid:903203194; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"95:35:1c:56:e6:e3:bd:18:eb:0f:5d:53:f0:1c:f6:41:d2:bb:bd:32"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/95351c56e6e3bd18eb0f5d53f01cf641d2bbbd32/; sid:903203195; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"a0:1e:50:8e:82:3a:bb:b7:dd:19:fa:b5:51:48:e6:60:e0:f4:af:69"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a01e508e823abbb7dd19fab55148e660e0f4af69/; sid:903203196; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"6d:9c:39:e6:b7:81:fe:48:25:38:f8:ba:56:4d:b4:d7:71:0d:9a:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6d9c39e6b781fe482538f8ba564db4d7710d9af8/; sid:903203197; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"25:74:5a:c1:e2:25:f6:56:82:7d:67:ad:fa:0b:56:2f:b7:7e:45:ef"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/25745ac1e225f656827d67adfa0b562fb77e45ef/; sid:903203198; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (DanaBot C&C)"; tls_cert_fingerprint; content:"ef:05:4f:54:df:0f:a6:7f:c4:54:bf:88:94:c6:43:e4:4c:28:ec:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ef054f54df0fa67fc454bf8894c643e44c28ec3a/; sid:903203199; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"28:18:d4:13:5c:c5:16:3d:2c:ea:df:a6:42:48:a0:c4:55:f7:a4:f7"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2818d4135cc5163d2ceadfa64248a0c455f7a4f7/; sid:903203200; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"72:35:cf:3e:e7:b6:19:a2:c4:9d:bd:e0:25:56:a8:7b:88:9b:43:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/7235cf3ee7b619a2c49dbde02556a87b889b43df/; sid:903203201; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"ca:d2:32:bb:fe:05:d3:e9:a1:12:e3:a0:53:f3:90:f0:b4:fc:0d:41"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cad232bbfe05d3e9a112e3a053f390f0b4fc0d41/; sid:903203202; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"1a:62:6a:33:ec:91:a6:3d:9a:a3:80:e5:33:81:02:52:41:9d:46:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1a626a33ec91a63d9aa380e533810252419d469b/; sid:903203203; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"d1:a1:cc:52:62:31:86:1e:2e:a9:aa:69:b2:58:34:e2:79:86:1d:38"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d1a1cc526231861e2ea9aa69b25834e279861d38/; sid:903203204; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"ea:c9:48:ef:2a:ea:a0:42:c7:e1:31:1e:3f:36:75:1b:e3:3a:af:ed"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eac948ef2aeaa042c7e1311e3f36751be33aafed/; sid:903203205; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"49:b7:67:73:6a:0c:ee:6c:3c:04:70:f1:de:fa:1a:58:6d:8e:b9:6a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/49b767736a0cee6c3c0470f1defa1a586d8eb96a/; sid:903203206; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"fb:4c:48:55:c6:ad:0e:a2:2e:bf:94:e5:31:fe:56:dc:61:67:42:73"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fb4c4855c6ad0ea22ebf94e531fe56dc61674273/; sid:903203207; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"f8:92:b7:93:a9:9d:67:d6:cc:a8:72:6b:06:30:2a:44:16:65:c4:17"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f892b793a99d67d6cca8726b06302a441665c417/; sid:903203208; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"44:96:6d:7c:27:5e:9d:28:93:52:74:d8:dd:31:a6:59:8b:7b:85:79"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44966d7c275e9d28935274d8dd31a6598b7b8579/; sid:903203209; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"26:3e:25:63:ab:cd:a9:9f:db:65:e1:5e:ea:47:12:f9:de:03:11:78"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/263e2563abcda99fdb65e15eea4712f9de031178/; sid:903203210; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (DanaBot C&C)"; tls_cert_fingerprint; content:"c6:72:48:45:35:0b:17:45:f0:2d:14:30:a5:d2:75:78:a4:4a:9e:19"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c6724845350b1745f02d1430a5d27578a44a9e19/; sid:903203211; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"b0:da:a3:91:38:e2:28:d7:37:01:80:55:5d:32:dc:34:1d:31:9e:71"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b0daa39138e228d7370180555d32dc341d319e71/; sid:903203212; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"ce:1c:1a:0e:53:d3:10:d7:fc:e4:ba:51:6c:cd:9b:11:cc:4d:fd:08"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce1c1a0e53d310d7fce4ba516ccd9b11cc4dfd08/; sid:903203213; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"e5:7c:d2:58:01:ee:f1:0b:78:74:40:7a:41:3c:86:42:0b:b8:be:50"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e57cd25801eef10b7874407a413c86420bb8be50/; sid:903203214; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Dridex C&C)"; tls_cert_fingerprint; content:"54:fd:0d:8d:91:88:29:0f:21:c4:70:e9:64:b0:e4:4d:ab:0b:19:dc"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/54fd0d8d9188290f21c470e964b0e44dab0b19dc/; sid:903203215; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"04:47:ac:2b:c5:a1:fd:a9:71:06:58:f1:5a:eb:bf:70:a8:fd:a6:67"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0447ac2bc5a1fda9710658f15aebbf70a8fda667/; sid:903203216; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"8c:2a:10:d9:fd:c2:27:84:76:22:5f:cf:f9:a3:ba:f0:25:5a:1d:05"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8c2a10d9fdc2278476225fcff9a3baf0255a1d05/; sid:903203217; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"de:53:8f:f2:47:ff:d4:5f:7b:d0:41:28:c7:cb:99:23:32:1f:e1:1a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/de538ff247ffd45f7bd04128c7cb9923321fe11a/; sid:903203218; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"99:b8:7e:84:b8:3e:16:80:48:4c:cd:c5:a0:2f:cc:6f:2a:0a:8f:c1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/99b87e84b83e1680484ccdc5a02fcc6f2a0a8fc1/; sid:903203219; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"64:75:fe:ce:0d:52:e4:eb:38:73:31:07:3d:60:fa:86:80:2d:03:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/6475fece0d52e4eb387331073d60fa86802d033d/; sid:903203220; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"0c:4d:4b:af:62:c4:7d:ed:cc:53:47:4a:bf:22:73:73:a1:68:ed:d4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0c4d4baf62c47dedcc53474abf227373a168edd4/; sid:903203221; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"c7:01:8c:e8:ca:b9:27:7d:61:49:d2:18:d2:3c:9f:81:70:91:33:da"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c7018ce8cab9277d6149d218d23c9f81709133da/; sid:903203222; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AZORult C&C)"; tls_cert_fingerprint; content:"32:ca:92:79:9c:de:5f:05:8c:48:a4:18:95:62:cd:8a:cb:a9:07:6e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/32ca92799cde5f058c48a4189562cd8acba9076e/; sid:903203223; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"9b:b3:1f:52:6f:68:35:d3:b0:21:00:99:9e:ec:a4:2f:46:aa:2b:1d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9bb31f526f6835d3b02100999eeca42f46aa2b1d/; sid:903203224; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"8d:a3:df:71:aa:80:c8:40:18:cd:a6:95:dc:2b:79:c5:23:44:f5:3b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8da3df71aa80c84018cda695dc2b79c52344f53b/; sid:903203225; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"5c:b6:4c:59:c5:a9:58:2e:6a:fc:fd:b1:09:bb:63:9a:09:aa:48:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5cb64c59c5a9582e6afcfdb109bb639a09aa48c3/; sid:903203226; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"cf:33:04:bd:32:1b:3b:20:9d:f0:78:78:f2:4d:52:8c:5f:1b:55:57"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/cf3304bd321b3b209df07878f24d528c5f1b5557/; sid:903203227; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"01:12:b0:09:ef:49:9a:f2:78:57:77:7b:45:9e:aa:b5:b2:16:b4:9d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0112b009ef499af27857777b459eaab5b216b49d/; sid:903203228; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"9a:8b:74:cf:a6:30:48:0b:22:4e:ae:f0:6e:96:0c:a1:54:ab:df:fb"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/9a8b74cfa630480b224eaef06e960ca154abdffb/; sid:903203229; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"89:f9:bf:31:8b:85:ab:fb:7a:33:3c:4e:2e:7b:7c:2f:a6:24:44:a1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/89f9bf318b85abfb7a333c4e2e7b7c2fa62444a1/; sid:903203230; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"ee:1c:f7:03:9a:79:2a:95:3a:d0:aa:33:50:33:da:8d:0d:16:22:b5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ee1cf7039a792a953ad0aa335033da8d0d1622b5/; sid:903203231; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ServHelper C&C)"; tls_cert_fingerprint; content:"f7:05:1a:8e:b2:7e:dc:f7:41:a3:f2:fd:03:45:e9:27:57:8e:a8:93"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f7051a8eb27edcf741a3f2fd0345e927578ea893/; sid:903203232; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"10:6b:0e:e8:3c:92:40:47:ca:99:4e:3f:6c:be:ed:94:c1:48:fb:ff"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/106b0ee83c924047ca994e3f6cbeed94c148fbff/; sid:903203233; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"8d:35:95:ce:e5:06:d4:85:5f:e3:45:cc:eb:aa:12:c8:39:e6:8f:f8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8d3595cee506d4855fe345ccebaa12c839e68ff8/; sid:903203234; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"43:dc:ed:0f:b9:41:5d:53:df:98:0c:f3:bb:80:bc:89:2e:1d:cb:94"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/43dced0fb9415d53df980cf3bb80bc892e1dcb94/; sid:903203235; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"82:50:11:3c:6e:43:e8:0c:65:59:6e:b9:d5:db:f9:c0:c9:94:87:9f"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8250113c6e43e80c65596eb9d5dbf9c0c994879f/; sid:903203236; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"b2:c3:8a:5b:49:5e:2c:49:06:80:ce:a7:cd:71:22:8a:56:bf:cb:44"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/b2c38a5b495e2c490680cea7cd71228a56bfcb44/; sid:903203237; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"14:2d:6b:4f:56:73:ad:e8:dd:09:fa:3d:70:5b:e3:29:ad:fb:75:31"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/142d6b4f5673ade8dd09fa3d705be329adfb7531/; sid:903203238; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"2c:14:95:47:0f:7d:45:37:f2:c7:6d:50:16:b3:6f:3f:d0:70:6f:ad"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/2c1495470f7d4537f2c76d5016b36f3fd0706fad/; sid:903203239; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"1f:1f:c1:a9:23:5b:9b:51:4f:00:e2:95:90:25:48:13:7d:5c:01:c9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/1f1fc1a9235b9b514f00e295902548137d5c01c9/; sid:903203240; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"22:a7:01:74:5f:df:a2:08:0e:44:c9:f3:39:a9:11:f9:7a:d1:7b:d0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/22a701745fdfa2080e44c9f339a911f97ad17bd0/; sid:903203241; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"01:a8:0c:68:68:94:2b:d8:e7:6d:5b:d2:11:95:2d:c5:70:9a:ea:e1"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/01a80c6868942bd8e76d5bd211952dc5709aeae1/; sid:903203242; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"c2:38:c6:22:ca:6e:48:ce:f9:eb:ab:e4:08:67:4f:31:db:7f:79:b9"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/c238c622ca6e48cef9ebabe408674f31db7f79b9/; sid:903203243; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"68:12:6a:31:06:49:a2:4b:20:3b:32:b1:2d:c4:88:a5:4b:60:25:80"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/68126a310649a24b203b32b12dc488a54b602580/; sid:903203244; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"ee:cf:ab:4c:20:72:e9:e1:e3:1b:cc:71:04:bf:6a:c8:34:e1:d5:af"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/eecfab4c2072e9e1e31bcc7104bf6ac834e1d5af/; sid:903203245; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"f1:d7:c7:94:7e:3b:96:6f:6e:62:7a:fe:85:0f:a0:1f:83:56:29:e4"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f1d7c7947e3b966f6e627afe850fa01f835629e4/; sid:903203246; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"ce:75:30:87:87:70:6e:09:e3:bd:c1:90:b9:9d:f4:9b:a8:d7:f5:9b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ce75308787706e09e3bdc190b99df49ba8d7f59b/; sid:903203247; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"f0:5a:89:8b:08:ce:2b:b6:3a:4f:a9:3c:11:4c:b0:03:0f:da:03:e8"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/f05a898b08ce2bb63a4fa93c114cb0030fda03e8/; sid:903203248; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (IcedID C&C)"; tls_cert_fingerprint; content:"22:9d:13:a4:9d:fa:e4:8a:d6:d4:33:22:6d:e2:60:20:f2:b8:d9:e5"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/229d13a49dfae48ad6d433226de26020f2b8d9e5/; sid:903203249; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"ff:f9:31:0e:e2:eb:b0:13:60:f0:2c:6b:54:2d:e5:2d:75:af:fc:35"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fff9310ee2ebb01360f02c6b542de52d75affc35/; sid:903203250; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"8f:d2:8e:bc:f7:7a:f7:51:b8:4d:5b:88:7b:ec:9d:12:83:ff:7e:a0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/8fd28ebcf77af751b84d5b887bec9d1283ff7ea0/; sid:903203251; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Gozi C&C)"; tls_cert_fingerprint; content:"d3:ef:e0:96:0e:22:39:fa:6d:d8:77:e0:22:41:4c:82:32:1d:d3:96"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/d3efe0960e2239fa6dd877e022414c82321dd396/; sid:903203252; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"5a:9b:ab:13:82:67:f8:d1:9b:17:bc:07:ef:f7:d8:49:ce:f7:db:1e"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/5a9bab138267f8d19b17bc07eff7d849cef7db1e/; sid:903203253; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"a6:dc:d9:2f:f1:12:e9:82:7f:cd:65:48:d1:8a:66:de:26:c6:dc:3c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/a6dcd92ff112e9827fcd6548d18a66de26c6dc3c/; sid:903203254; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ZLoader C&C)"; tls_cert_fingerprint; content:"e8:dd:fc:b2:44:57:e0:64:2c:69:f5:67:e5:8e:51:d0:36:54:61:4c"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/e8ddfcb24457e0642c69f567e58e51d03654614c/; sid:903203255; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"ad:7a:c3:6b:f6:a1:c8:b8:ac:a4:60:b8:72:78:c4:4d:bf:77:94:6b"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/ad7ac36bf6a1c8b8aca460b87278c44dbf77946b/; sid:903203256; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (QNodeService C&C)"; tls_cert_fingerprint; content:"0a:1e:17:13:c9:9e:6e:cf:fd:91:93:b0:05:4e:a1:0c:a5:65:20:df"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/0a1e1713c99e6ecffd9193b0054ea10ca56520df/; sid:903203257; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)"; tls_cert_fingerprint; content:"61:28:3e:ae:0d:2b:41:04:c1:ae:72:55:57:4c:da:72:be:c1:28:bd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/61283eae0d2b4104c1ae7255574cda72bec128bd/; sid:903203258; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (OrcusRAT C&C)"; tls_cert_fingerprint; content:"87:b9:01:1d:00:d5:06:95:26:65:a9:e4:e4:c1:08:4e:60:50:59:c3"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/87b9011d00d506952665a9e4e4c1084e605059c3/; sid:903203259; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"84:fd:82:83:d1:73:6f:a4:18:c6:a3:ea:51:61:ff:1d:e7:9e:b2:dd"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/84fd8283d1736fa418c6a3ea5161ff1de79eb2dd/; sid:903203260; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (DanaBot C&C)"; tls_cert_fingerprint; content:"96:a4:9f:e8:7b:e0:f4:75:99:a1:b0:f2:bd:cf:fc:93:26:13:1e:65"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/96a49fe87be0f47599a1b0f2bdcffc9326131e65/; sid:903203261; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"61:76:11:98:63:32:d2:56:d2:2a:bb:7c:75:0b:6f:42:3d:b4:22:3a"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/617611986332d256d22abb7c750b6f423db4223a/; sid:903203262; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Malware C&C)"; tls_cert_fingerprint; content:"fd:01:f8:e1:90:37:89:cf:6f:3c:7f:7d:9b:26:66:b8:76:c9:e0:27"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/fd01f8e1903789cf6f3c7f7d9b2666b876c9e027/; sid:903203263; rev:1;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (BuerLoader C&C)"; tls_cert_fingerprint; content:"b1:aa:79:cd:8a:c3: