SystemBC SOCKS5 Proxy Handshake - Gentlemen Ransomware Affiliate C2

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects a specific network handshake pattern (05 01 00) associated with the SystemBC malware acting as a SOCKS5 proxy. This pattern is characteristic of the initial communication phase used by SystemBC to establish C2 connectivity, often utilized by ransomware affiliates.