Rancor has used HTTP for C2.^[1]

Rancor has used cmd.exe to execute commmands.^[1]

Rancor has used VBS scripts as well as embedded macros for execution.^[1]

Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.^[2]

Rancor has downloaded additional malware, including by usingcertutil.^[1]

Rancor has attached a malicious document to an email to gain initial access.^[1]

Rancor launched a scheduled task to gain persistence using theschtasks /create /sc command.^[1]

Rancor has usedmsiexec to download and execute malicious installer files over HTTP.^[1]

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.^[1]