SystemBC Malware: SOCKS5 Proxy and Backdoor Intelligence

SystemBC (also known as Coroxy) is a sophisticated Windows malware family that functions as both a SOCKS5 proxy and a persistent Remote Access Trojan (RAT). First identified in 2018, it has transitioned into a prominent Malware-as-a-Service (MaaS) tool utilized by high-profile threat actors such as Wizard Spider and FIN7. It is frequently deployed as a second-stage payload in ransomware intrusions involving Ryuk, Conti, BlackBasta, and Play to facilitate command-and-control (C2) stealth and lateral movement.

Technically, the malware establishes encrypted tunnels—recently evolving from raw TCP to Tor-based communication—to mask the traffic of other malicious tools. It maintains persistence through scheduled tasks and registry keys while providing operators with a 'point-and-shoot' capability to execute EXE, DLL, VBS, and PowerShell scripts directly in memory. This versatility allows attackers to perform discovery and exfiltration without a significant forensic footprint.

SystemBC represents a critical threat due to its widespread adoption across the ransomware ecosystem and its ability to blend into legitimate network traffic. Its use in targeting various sectors including Healthcare, Government, and Financial Services necessitates robust detection for unauthorized proxy activity and unusual scheduled task creation.