Here is the script hosted on Pastebin: Reflective loader downloaded from pastebin.com The script executes a hardcoded PE file located — Gandcrab —at the end of the script using a reflective DLL-loading technique. In addition to the ransomware, we identified another actor trying to execute a Monero miner on the vulnerable server with China Chopper: