SYSTEMBC

T1583 Acquire Infrastructure QuadSwitcher acquired infrastructure to host their tooling.

Utilisation de VPS hébergés chez VULTR comme serveurs C2 SystemBC, et utilisation du port 4177.

T1588.001 Obtain Capabilities: Malware The Play gang uses SystemBC, a commodity malware for sale.

T1608.001 Stage Capabilities: Upload Malware The Play gang uploaded its own tooling to a dedicated server to be used during intrusions.

In some cases, the SystemBC RAT was deployed to servers after the attackers have gained administrative credentials and moved deep into the targeted network.

The program is commonly used for persistent access to a victim network or left behind as a secondary ingress point in case the primary is discovered and remediated.

In the Ryuk attacks we saw with SystemBC, initial compromise came from phishing messages that delivered the Buer Loader malware; other attacks in the same campaign used Bazar or Zloader. The Egregor attacks we saw used another loader dropped by malicious emails—Qbot.

Vice Society actors have been observed using ... 'living off the land' techniques targeting the legitimate Windows Management Instrumentation (WMI) service [T1047].

Once the file has been downloaded, the implant saves the file to the %TEMP% directory with a filename consisting of random lowercase characters and the file extension. The implant will set up a scheduled task to run the downloaded file.

SystemBC can parse and execute EXE or DLL data blobs passed over the Tor connection, shell code, VBS scripts, Windows commands and batch scripts, and PowerShell scripts.

For Powershell commands, it creates a scheduled task for the script and adds the following command line to make it hidden: '-WindowStyle Hidden -ep bypass -file "'

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution. | During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.

Contagious Interview has utilized VBS scripts to open cmd.exe and run commands to include the go_batch.bat batch file. During FunnyDream, the threat actors used cmd.exe to execute the wmiexec.vbs script. SystemBC has used cmd.exe to execute VBS scripts, BAT scripts and CMD scripts.

Once the file has been downloaded, the implant saves the file to the %TEMP% directory with a filename consisting of random lowercase characters and the file extension. The implant will set up a scheduled task to run the downloaded file.

In some cases, the SystemBC RAT was deployed to servers after the attackers have gained administrative credentials and moved deep into the targeted network.

The program is commonly used for persistent access to a victim network or left behind as a secondary ingress point in case the primary is discovered and remediated.

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.

Once the file has been downloaded, the implant saves the file to the %TEMP% directory with a filename consisting of random lowercase characters and the file extension. The implant will set up a scheduled task to run the downloaded file.

In some cases, the SystemBC RAT was deployed to servers after the attackers have gained administrative credentials and moved deep into the targeted network.

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.

The collected data is rc4 encrypted with a hard-coded key before it is sent it to CnC, using a socket connection handled by the malware’s mini-tor library and socket APIs.

Since at least February 2020, FIN12 has leveraged a series of in-memory droppers including, MALTSHAKE, ICECANDLE, WHITEDAGGER, WEIRDLOOP, and templates associated with Cobalt Strike's Artifact Kit to deploy various malware payloads.

In some cases, the SystemBC RAT was deployed to servers after the attackers have gained administrative credentials and moved deep into the targeted network.

The implant will download this file directly into memory. It then sets the area of memory via the VirtualProtect Windows API call to executable by passing in 0x40, and then executes it via the CreateThread call... Unlike the loader, the implant does not write the downloaded shellcode file to disk before execution.

FIN12 has frequently leveraged code-signed payloads in their operations.

When the bot is executed from scheduled task, it collects the following information and store it in a buffer and sends it to CnC through the Tor connection: The active Windows user name The Windows build number for the infected system A WOW process check (whether the OS on the infected system is 32-bit or 64-bit) The volume serial number.

Its affiliates are increasingly leveraging SystemBC malware, a proxy and backdoor tool often used in human-operated ransomware attacks, to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments.

The attacker began extracting data using SystemBC and Rclone, stealing approximately 1 TB of information within 24 hours.

Play ransomware actors use command-and-control applications such as Cobalt Strike and SystemBC

FIN12 commonly uses SYSTEMBC malware to proxy remote connections to hosts within victim environments.

The FRP client can be configured to connect to the server through a proxy. The server component of SystemBC has used SOCKS5 for C2 communication. Keydnap uses a copy of tor2web proxy for HTTPS communications.

Its affiliates are increasingly leveraging SystemBC malware, a proxy and backdoor tool often used in human-operated ransomware attacks, to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments.

In order to run a file on a victim machine, a direct URL needs to be submitted to the file in the “LOAD URL” textbox within the “LOADER” page. This will trigger the implant to execute a GET request for file download. The implant can download via both HTTP and HTTPS.

T1132.002 Data Encoding: Non-Standard Encoding SystemBC employs a custom network protocol.

SystemBC est un code malveillant disponible à l’achat sur des forums cybercriminels, il permet d’établir un tunnel SOCKS5 entre la machine compromise et le serveur de l’attaquant.

The attacker began extracting data using SystemBC and Rclone, stealing approximately 1 TB of information within 24 hours.