SystemBC (Windows)

Aliases: Coroxy, DroxiDat

First seen
2019-08-01 00:00:00
Malware type
downloader, trojan
Family
Malware family
Last IoC activity
2026-07-22 00:39:19
Profile updated
2026-07-07 13:03:08

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications

Context

SystemBC is a multiplatform proxy malware active since August 2019. It creates SOCKS5 network tunnels in the victim’s network and connects to its C2 server using a custom, RC4-encrypted protocol. It can also download and execute additional malware, with payloads either written to disk or mapped into memory. The SystemBC kit, including the C2 panel, server, and malware executables, is sold in underground forums.

Used by threat actors

Reports & references

  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • Mandiant — Melting Unc2198 Icedid To Ransomware Operations (report)
  • Mandiant — Chasing Avaddon Ransomware (report)
  • services.google.com — M Trends 2025 En (report)
  • cloud.google.com — Unc4393 Goes Gently Into Silentnight (report)
  • Microsoft — Threat Actors Misusing Quick Assist In Social Engineering Attacks Leading To Ransomware (report)
  • elastic.co — Cuba Ransomware Campaign Analysis (report)
  • CISA — Aa22 249A (report)
  • CrowdStrike — Hypervisor Jackpotting Lack Of Antivirus Support Opens The Door To Adversaries (report)
  • asec.ahnlab.com — 33600 (report)
  • thedfirreport.com — Cobalt Strike And A Pair Of Socks Lead To Lockbit Ransomware (report)
  • blog.reversinglabs.com — Code Reuse Across Packers And Dll Loaders (report)
  • Broadcom/Symantec — Play Ransomware Volume Shadow Copy (report)
  • medium.com — Inside The Systembc Malware As A Service 9Aa03Afd09C6 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Systembc (report)
  • proofpoint.com — Systembc Christmas July Socks5 Malware And Exploit Kits (report)
  • labs.f-secure.com — Prelude To Ransomware Systembc (report)
  • docs.velociraptor.app — Systembc (report)
  • github.com — The%20Swiss%20Knife Systembc En (report)
  • medium.com — Systembc Powershell Version 68C9Aad0F85C (report)
  • cyber.wtf — Defeating Vmprotects Latest Tricks (report)
  • news.sophos.com — Systembc (report)
  • Kaspersky — 110302 (report)
  • kroll.com — Inside The Systembc Malware Server (report)
  • bitsight.com — Systembc Multipurpose Proxy Bot Still Breathes (report)

External references