SYMBOLCOMMON_NAMEaka. SYNONYMS
win.systembc (Back to overview)

SystemBC

aka: Coroxy, DroxiDat

Actor(s): Vanilla Tempest

VTCollection    

SystemBC is a multiplatform proxy malware active since August 2019. It creates SOCKS5 network tunnels in the victim’s network and connects to its C2 server using a custom, RC4-encrypted protocol. It can also download and execute additional malware, with payloads either written to disk or mapped into memory. The SystemBC kit, including the C2 panel, server, and malware executables, is sold in underground forums.

References
2026-02-04 ⋅ Silent Push ⋅ João Batista, Silent Push
Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware Family
SystemBC SystemBC
2025-09-18 ⋅ Lumen ⋅ Black Lotus Labs
SystemBC – Bringing the Noise
SystemBC SystemBC
2025-07-18 ⋅ Arctic Wolf ⋅ Arctic Wolf Labs Team
Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC
AllaKore SystemBC
2025-04-24 ⋅ Mandiant ⋅ Mandiant
M-Trends 2025 Report
Akira Black Basta LockBit SystemBC GootLoader LockBit WIREFIRE Akira Black Basta Cobalt Strike LockBit RansomHub SystemBC Pink Sandstorm
2025-01-27 ⋅ The DFIR Report ⋅ MittenSec, MyDFIR, r3nzsec
Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware
GhostSocks LockBit SystemBC
2024-12-04 ⋅ Rapid7 ⋅ Tyler McGraw
Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
Black Basta Cobalt Strike DarkGate SystemBC Zloader
2024-08-26 ⋅ The DFIR Report ⋅ The DFIR Report
BlackSuit Ransomware
BlackSuit Cobalt Strike SystemBC
2024-08-12 ⋅ Rapid7 ⋅ Tyler McGraw
Ongoing Social Engineering Campaign Refreshes Payloads
Black Basta Cobalt Strike GhostSocks Lumma Stealer SystemBC
2024-07-29 ⋅ Mandiant ⋅ Ashley Pearson, Jake Nicastro, Joseph Pisano, Josh Murchie, Joshua Shilko, Raymond Leong
UNC4393 Goes Gently into the SILENTNIGHT
Black Basta QakBot sRDI SystemBC Zloader UNC3973 UNC4393
2024-05-30 ⋅ Europol ⋅ Europol
Largest ever operation against botnets hits dropper malware ecosystem
BumbleBee IcedID SmokeLoader SystemBC TrickBot
2024-05-15 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
Black Basta Cobalt Strike QakBot SystemBC
2024-02-26 ⋅ Morphisec ⋅ Michael Dereviashkin
Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering Remcos RAT to a Ukraine Entity in Finland
SystemBC Babadeda DanaBot HijackLoader Remcos SystemBC UAC-0184
2024-01-19 ⋅ Kroll ⋅ David Truman
Inside the SYSTEMBC Command-and-Control Server
SystemBC
2023-11-12 ⋅ Github (vc0RExor) ⋅ Aaron Jornet
The Swiss Knife: SystemBC | Coroxy
SystemBC
2023-10-12 ⋅ YouTube (FIRST) ⋅ Aditya K. Sood
"Compromising the Keys to the Kingdom" - Exfiltrating Data to Own and Operate the Exploited Systems
Loki RAT SystemBC
2023-09-12 ⋅ FIRSTCON ⋅ Aditya K. Sood
Compromising the Keys to the Kingdom: Exfiltrating Data to Own and Operate the Exploited Systems (Slides)
Loki RAT SystemBC
2023-09-12 ⋅ ⋅ ANSSI ⋅ ANSSI
FIN12: A Cybercriminal Group with Multiple Ransomware
BlackCat Cobalt Strike Conti Hive MimiKatz Nokoyawa Ransomware PLAY Royal Ransom Ryuk SystemBC
2023-08-23 ⋅ Logpoint ⋅ Anish Bogati, Nischal khadgi
Defending Against 8base: Uncovering Their Arsenal and Crafting Responses
8Base Phobos SmokeLoader SystemBC
2023-08-10 ⋅ Kaspersky ⋅ Kurt Baumgartner
Focus on DroxiDat/SystemBC
SystemBC
2023-06-28 ⋅ vmware ⋅ Bria Beathley, Dana Behling, Deborah Snyder, Fae Carlisle
8Base Ransomware: A Heavy Hitting Player
8Base Phobos SmokeLoader SystemBC
2023-06-27 ⋅ SecurityIntelligence ⋅ Charlotte Hammond, Ole Villadsen
The Trickbot/Conti Crypters: Where Are They Now?
Black Basta Conti Mount Locker PhotoLoader Royal Ransom SystemBC TrickBot
2023-06-22 ⋅ Reliaquest ⋅ Caroline Fenstermacher
Goot to Loot - How a Gootloader Infection Led to Credential Access
GootLoader SystemBC
2023-05-15 ⋅ CrowdStrike ⋅ CrowdStrike
Hypervisor Jackpotting, Part 3: Lack of Antivirus Support Opens the Door to Adversary Attacks
BlackCat SystemBC
2023-04-19 ⋅ Symantec ⋅ Threat Hunter Team
Play Ransomware Group Using New Custom Data-Gathering Tools
PLAY SystemBC
2023-04-18 ⋅ Mandiant ⋅ Mandiant
M-Trends 2023
QUIETEXIT AppleJeus Black Basta BlackCat CaddyWiper Cobalt Strike Dharma HermeticWiper Hive INDUSTROYER2 Ladon LockBit Meterpreter PartyTicket PlugX QakBot REvil Royal Ransom SystemBC WhisperGate
2023-03-30 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
eSentire Threat Intelligence Malware Analysis: BatLoader
BATLOADER Cobalt Strike ISFB SystemBC Vidar
2023-02-14 ⋅ Cybereason ⋅ Cybereason Incident Response (IR) team
GootLoader - SEO Poisoning and Large Payloads Leading to Compromise
GootLoader Cobalt Strike SystemBC
2023-02-09 ⋅ cyber.wtf blog ⋅ Hendrik Eckardt
Defeating VMProtect’s Latest Tricks
SystemBC
2023-01-23 ⋅ Kroll ⋅ Elio Biasiotto, Stephen Green
Black Basta – Technical Analysis
Black Basta Cobalt Strike MimiKatz QakBot SystemBC
2023-01-16 ⋅ Intrinsec ⋅ Intrinsec
ProxyNotShell – OWASSRF – Merry Xchange
Cobalt Strike SystemBC
2022-10-28 ⋅ velociraptor ⋅ Matt Green
Windows.Carving.SystemBC - SystemBC RAT configuration Purser for Velociraptor
SystemBC
2022-10-10 ⋅ RiskIQ ⋅ Microsoft Threat Intelligence Center (MSTIC)
DEV-0832 Leverages Commodity Tools in Opportunistic Ransomware Campaigns
BlackCat Mount Locker SystemBC Zeppelin
2022-09-21 ⋅ BitSight ⋅ João Batista
SystemBC: The Multipurpose Proxy Bot Still Breathes
SystemBC
2022-09-06 ⋅ CISA ⋅ CISA, FBI, MS-ISAC, US-CERT
Alert (AA22-249A) #StopRansomware: Vice Society
Cobalt Strike Empire Downloader FiveHands HelloKitty SystemBC Zeppelin
2022-08-30 ⋅ Cisco ⋅ Vanja Svajcer
ModernLoader delivers multiple stealers, cryptominers and RATs
Coinminer DCRat ModernLoader RedLine Stealer SapphireMiner SystemBC
2022-06-01 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Salim Bitam, Seth Goodwin
CUBA Ransomware Campaign Analysis
Cobalt Strike Cuba Meterpreter MimiKatz SystemBC
2022-05-24 ⋅ BitSight ⋅ BitSight, João Batista, Pedro Umbelino
Emotet Botnet Rises Again
Cobalt Strike Emotet QakBot SystemBC
2022-05-09 ⋅ Microsoft Security ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
Griffon BazarBackdoor BlackCat BlackMatter Blister Gozi LockBit Pandora Rook SystemBC TrickBot
2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT
2022-04-12 ⋅ AhnLab ⋅ ASEC Analysis Team
SystemBC Being Used by Various Attackers
Emotet SmokeLoader SystemBC
2022-03-04 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
SystemBC, PowerShell version
SystemBC
2022-01-19 ⋅ Mandiant ⋅ Adrian Sanchez Hernandez, Ervin James Ocampo, Paul Tarter
One Source to Rule Them All: Chasing AVADDON Ransomware
BlackMatter Avaddon BlackMatter MedusaLocker SystemBC ThunderX
2021-06-07 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Inside the SystemBC Malware-As-A-Service
Ryuk SystemBC TrickBot
2021-05-19 ⋅ Intel 471 ⋅ Intel 471
Look how many cybercriminals love Cobalt Strike
BazarBackdoor Cobalt Strike Hancitor QakBot SmokeLoader SystemBC TrickBot
2021-05-10 ⋅ F-Secure ⋅ Callum Roxan, Sami Ruohonen
Prelude to Ransomware: SystemBC
SystemBC
2021-04-21 ⋅ SophosLabs Uncut ⋅ Anand Aijan, Andrew Brandt, Markel Picado, Michael Wood, Sean Gallagher, Sivagnanam Gn, Suriya Natarajan
Nearly half of malware now use TLS to conceal communications
Agent Tesla Cobalt Strike Dridex SystemBC
2021-04-01 ⋅ Reversing Labs ⋅ Robert Simmons
Code Reuse Across Packers and DLL Loaders
IcedID SystemBC
2021-02-25 ⋅ FireEye ⋅ Brendan McKeague, Bryce Abdo, Van Ta
So Unchill: Melting UNC2198 ICEDID to Ransomware Operations
MOUSEISLAND Cobalt Strike Egregor IcedID Maze SystemBC
2021-02-03 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Excel spreadsheets push SystemBC malware
Cobalt Strike SystemBC
2020-12-16 ⋅ SophosLabs Uncut ⋅ Sean Gallagher, Sivagnanam Gn
Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor
SystemBC
2020-10-14 ⋅ Sophos ⋅ Sean Gallagher
They’re back: inside a new Ryuk ransomware attack
Cobalt Strike Ryuk SystemBC
2019-07-31 ⋅ Proofpoint ⋅ Dennis Schwarz, Kade Harmon, Kafeine, Proofpoint Threat Insight Team
SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits
SystemBC
Yara Rules
[TLP:WHITE] win_systembc_auto (20260917 | Detects win.systembc.)
rule win_systembc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.systembc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b000 ae 75fd 8a57fe 80fa39 }
            // n = 5, score = 1200
            //   b000                 | mov                 al, 0
            //   ae                   | scasb               al, byte ptr es:[edi]
            //   75fd                 | jne                 0xffffffff
            //   8a57fe               | mov                 dl, byte ptr [edi - 2]
            //   80fa39               | cmp                 dl, 0x39

        $sequence_1 = { 742b ff7518 6a00 6a00 ff75fc }
            // n = 5, score = 1100
            //   742b                 | dec                 eax
            //   ff7518               | sub                 esp, 0x20
            //   6a00                 | dec                 eax
            //   6a00                 | lea                 ecx, [ebp - 0x70]
            //   ff75fc               | dec                 eax

        $sequence_2 = { 6a00 8d85fcfbffff 50 8b45f8 8b08 50 }
            // n = 6, score = 1100
            //   6a00                 | mov                 edx, 0
            //   8d85fcfbffff         | stosd               dword ptr es:[edi], eax
            //   50                   | dec                 eax
            //   8b45f8               | mov                 eax, dword ptr [ebp + 0x30]
            //   8b08                 | stosd               dword ptr es:[edi], eax
            //   50                   | dec                 eax

        $sequence_3 = { 6880b55cd6 8b45f8 8b08 8b91a8000000 50 ffd2 }
            // n = 6, score = 1100
            //   6880b55cd6           | mov                 al, 0
            //   8b45f8               | scasb               al, byte ptr es:[edi]
            //   8b08                 | jne                 0xffffffff
            //   8b91a8000000         | mov                 dl, byte ptr [edi - 2]
            //   50                   | cmp                 dl, 0x39
            //   ffd2                 | scasb               al, byte ptr es:[edi]

        $sequence_4 = { c745e801000000 c745ec06000000 8d45dc 50 8d45e0 50 }
            // n = 6, score = 1100
            //   c745e801000000       | dec                 eax
            //   c745ec06000000       | lea                 ecx, [0x23ca]
            //   8d45dc               | dec                 eax
            //   50                   | mov                 edx, 0x32
            //   8d45e0               | dec                 esp
            //   50                   | lea                 eax, [edi + 4]

        $sequence_5 = { 397d08 7757 837d1000 740e 8b5510 8802 8a07 }
            // n = 7, score = 1100
            //   397d08               | mov                 dword ptr [esp + 0x10], edx
            //   7757                 | dec                 esp
            //   837d1000             | mov                 dword ptr [esp + 0x18], eax
            //   740e                 | push                ebp
            //   8b5510               | dec                 eax
            //   8802                 | mov                 ebp, esp
            //   8a07                 | push                ebx

        $sequence_6 = { ab 837d0c00 7403 ff47fc 837d0800 7403 }
            // n = 6, score = 1100
            //   ab                   | add                 esp, 0x20
            //   837d0c00             | dec                 eax
            //   7403                 | sub                 esp, 0x30
            //   ff47fc               | dec                 eax
            //   837d0800             | mov                 ecx, dword ptr [ebp - 0x68]
            //   7403                 | dec                 eax

        $sequence_7 = { 8b4514 ab 8b4518 ab b801000000 }
            // n = 5, score = 1100
            //   8b4514               | dec                 esp
            //   ab                   | mov                 ecx, eax
            //   8b4518               | dec                 eax
            //   ab                   | add                 esp, 0x20
            //   b801000000           | dec                 eax

        $sequence_8 = { ab b801000000 5e 5f }
            // n = 4, score = 1100
            //   ab                   | mov                 edx, 8
            //   b801000000           | dec                 eax
            //   5e                   | add                 esp, 0x20
            //   5f                   | dec                 eax

        $sequence_9 = { e8???????? 4883c420 4883ec20 488d8de0f2ffff 48c7c208000000 e8???????? 4883c420 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   4883c420             | dec                 eax
            //   4883ec20             | add                 esp, 0x30
            //   488d8de0f2ffff       | test                eax, eax
            //   48c7c208000000       | je                  0xffffff94
            //   e8????????           |                     
            //   4883c420             | dec                 eax

        $sequence_10 = { 488d0dca230000 48c7c232000000 4c8d4704 4c8bc8 e8???????? 4883c420 }
            // n = 6, score = 200
            //   488d0dca230000       | add                 esp, 0x20
            //   48c7c232000000       | dec                 eax
            //   4c8d4704             | sub                 esp, 0x20
            //   4c8bc8               | dec                 eax
            //   e8????????           |                     
            //   4883c420             | lea                 ecx, [ebp - 0xd20]

        $sequence_11 = { 4889542410 4c89442418 55 488bec 53 }
            // n = 5, score = 200
            //   4889542410           | dec                 eax
            //   4c89442418           | mov                 edx, 8
            //   55                   | dec                 eax
            //   488bec               | add                 esp, 0x20
            //   53                   | dec                 eax

        $sequence_12 = { 48c7c100000000 48c7c200000000 49c7c000000000 4c8d4f7c }
            // n = 4, score = 200
            //   48c7c100000000       | mov                 dword ptr [esp + 0x18], eax
            //   48c7c200000000       | push                ebp
            //   49c7c000000000       | dec                 eax
            //   4c8d4f7c             | mov                 ebp, esp

        $sequence_13 = { ab 488b4530 ab 48c7c001000000 }
            // n = 4, score = 200
            //   ab                   | add                 esp, 0x20
            //   488b4530             | dec                 eax
            //   ab                   | mov                 dword ptr [esp + 0x10], edx
            //   48c7c001000000       | dec                 esp

        $sequence_14 = { 4883c420 4883ec30 488b4d98 48c7c200000000 }
            // n = 4, score = 200
            //   4883c420             | lea                 eax, [edi + 4]
            //   4883ec30             | dec                 esp
            //   488b4d98             | mov                 ecx, eax
            //   48c7c200000000       | dec                 eax

        $sequence_15 = { 49c7c100000000 488d8530ffffff 4889442420 ff15???????? 4883c430 85c0 7492 }
            // n = 7, score = 200
            //   49c7c100000000       | dec                 ecx
            //   488d8530ffffff       | mov                 ecx, 0
            //   4889442420           | dec                 eax
            //   ff15????????         |                     
            //   4883c430             | lea                 eax, [ebp - 0xd0]
            //   85c0                 | dec                 eax
            //   7492                 | mov                 dword ptr [esp + 0x20], eax

    condition:
        7 of them and filesize < 75776
}
Download all Yara Rules