C2

Fileless

Windows

APT

SystemBC

SystemBC

SystemBC is a multi-purpose malware that turns infected Windows machines into SOCKS5 proxies so attackers can communicate with their command-and-control (C2) servers. Written in C, it uses RC4 over TCP to encrypt its data so detection and analysis are harder.

Key Insights

Key Insights

By setting up a SOCKS5 proxy on compromised systems SystemBC allows attackers to hide their traffic. This proxy allows attackers to route their traffic through the infected host so they can mask their true origin and make it harder for defenders to trace back to them.

Command-and-Control Communication

SystemBC communicates with its C2 servers using a custom binary protocol over TCP, with RC4 encryption. This encrypted communication means commands and data sent between the malware and its operators are confidential and evade intrusion detection systems that inspect unencrypted traffic.

Role in Multi-Stage Attacks

SystemBC is often deployed with other malware. It acts as a facilitator in attack chains. The proxy is used to hide the activities of other payloads like ransomware or data exfiltration tools so attackers can maintain persistence and do more malicious activity without raising immediate suspicion.

Known Variants

Known Variants

SystemBC is also known as Coroxy and DroxiDat. These are the same functionality but may have different features or deployment methods for different campaigns or threat actors.

SystemBC is also known as Coroxy and DroxiDat. These are the same functionality but may have different features or deployment methods for different campaigns or threat actors.

Mitigation Strategies

Mitigation Strategies

  • Monitor network traffic for unusual proxy activities that may indicate SystemBC presence.

  • Deploy intrusion detection systems (IDS) to identify and block traffic associated with SystemBC.

  • Regularly update endpoint security tools to detect and prevent new SystemBC variants.

  • Implement strict access controls and network segmentation to limit the spread of malware.

Targeted Industries or Sectors

Targeted Industries or Sectors

SystemBC has been used across various sectors, including healthcare, finance, and education, often as part of ransomware or data exfiltration campaigns.

SystemBC has been used across various sectors, including healthcare, finance, and education, often as part of ransomware or data exfiltration campaigns.

Associated Threat Actors

Associated Threat Actors

SystemBC is used by multiple ransomware groups, including the notorious Ryuk and Conti gangs, as a critical tool to evade detection and extend their attack campaigns.

SystemBC is used by multiple ransomware groups, including the notorious Ryuk and Conti gangs, as a critical tool to evade detection and extend their attack campaigns.

References