Blocking hosts on the RPC nodes list from @ifin would have helped blocking the payload.
https://lists.ifin.network/lists/rpc-nodes/index.html
https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool
lists.ifin.networkRPC Nodes - IFIN ListsA curated collection of long-term block lists and hunting targets for all organizations, along with documentation and explanations.