SystemBC is a sophisticated proxy malware that's been actively traded and deployed since August 2019. Unlike flashy ransomware or obvious trojans, SystemBC operates quietly in the background, creating hidden network tunnels that criminals use to move laterally through corporate networks, exfiltrate data, and deliver follow-on payloads without triggering immediate alarms. Originally sold as a toolkit in underground forums—complete with control panel, server software, and builder—SystemBC has become a preferred tool for ransomware operators and data-theft rings who need stealthy, persistent access to compromised systems.
Threat Profile
| Attribute | Value |
|---|---|
| Canonical Name | SystemBC |
| Known Aliases | Coroxy, DroxiDat |
| Malware Family | Proxy/Backdoor Toolkit |
| Platform | Windows (PE executables) |
| First Observed | August 2019 |
| Distribution Model | Sold as commercial malware kit with C2 panel |
| Primary Function | SOCKS5 proxy tunneling, payload delivery |
| Communication Protocol | Custom RC4-encrypted C2 protocol |
| Typical Payload Delivery | On-disk executable drops or in-memory injection |
| Common Co-Infections | Ryuk, Egregor, Maze ransomware; TrickBot, IcedID banking trojans |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, Windows services |
| Detection Difficulty | Moderate to High (fileless variants, encrypted traffic) |
How It Spreads
SystemBC doesn't typically arrive on its own—it's a second-stage tool deployed after an initial compromise. Attackers use SystemBC to maintain covert access once they've gained an initial foothold through other malware or exploitation. The most common infection pathway starts with a banking trojan like TrickBot or IcedID, which establishes the beachhead. Once the attackers identify a valuable target—a business network with exploitable data or ransom potential—they deploy SystemBC to create persistent, stealthy tunnels for command execution and data exfiltration.
Because SystemBC is sold as a complete kit in underground forums, multiple criminal groups use it, each with their own preferred distribution methods. Some threat actors bundle it with commodity loaders like Emotet (when that botnet was active), while others drop it manually after exploiting Remote Desktop Protocol (RDP) vulnerabilities or stolen credentials. In enterprise environments, we've seen SystemBC spread laterally through SMB shares and administrative tools like PsExec once the attackers have domain credentials.
- Phishing emails with malicious Office documents or PDF attachments that execute downloaders (Emotet, IcedID, TrickBot) as first-stage infections
- Exploit kits targeting unpatched browsers or plugins on websites compromised through malvertising campaigns
- RDP brute-force attacks against exposed Windows servers, followed by manual SystemBC deployment by the attacker
- Software cracks and pirated installers bundled with loaders that retrieve SystemBC as a secondary payload
- Supply chain compromises where legitimate software update mechanisms are hijacked to push malicious packages
- Lateral movement tools like PsExec, PowerShell remoting, or WMI used by attackers who already control one machine on a network
What It Does On Your Machine
Once executed, SystemBC establishes a SOCKS5 proxy tunnel that allows attackers to route their traffic through your infected computer. This serves two critical purposes: it hides the attacker's true location and lets them interact with other machines on your network as if they were sitting at your desk. The malware connects to its command-and-control (C2) server using a custom protocol protected with RC4 encryption, making the communication difficult for network security tools to identify or decode. Unlike traditional remote access trojans that expose themselves through open ports or reverse shells, SystemBC's proxy architecture blends more naturally with legitimate network traffic.
The toolkit's modular design allows operators to download and execute additional malware on demand. Some payloads are written to disk as conventional executables, while others are injected directly into memory—a technique that evades file-scanning antivirus engines. In ransomware operations, SystemBC typically arrives days or weeks before the encryption payload, giving attackers time to map the network, locate backup systems, exfiltrate valuable data, and position themselves for maximum damage. During this reconnaissance phase, the malware may remain dormant for extended periods, activating only when the C2 server sends commands.
SystemBC achieves persistence through multiple redundant mechanisms. It creates registry entries that trigger execution at system startup, establishes scheduled tasks that relaunch the malware if processes are terminated, and sometimes installs itself as a Windows service with an innocuous name. The malware typically runs with user-level privileges initially but may attempt privilege escalation through known Windows exploits or by stealing credentials from memory. File system artifacts vary by version, but common installation patterns include:
The malware's network behavior is deliberately subtle. Rather than generating massive traffic spikes, SystemBC creates small, periodic connections to its C2 infrastructure, sometimes remaining silent for hours between check-ins. When actively tunneling attacker traffic, the volume depends entirely on what operations they're conducting—exfiltrating gigabytes of files produces different patterns than simply maintaining access for future use. This variability makes behavioral detection challenging, particularly in environments with already-complex network activity.
Manual Removal — Step by Step
Disconnect from all networks immediately
Physically unplug Ethernet cables or disable Wi-Fi before proceeding. SystemBC's primary value to attackers is network access—isolating the machine prevents lateral movement and alerts the threat actors that you're attempting cleanup. If this is a business computer, notify your IT department before taking any further action. For home networks, disconnect the infected machine but leave other devices online so you can research or contact help.
Boot into Safe Mode with Networking
Restart the computer and press F8 repeatedly during boot (or use the Shift+Restart method in Windows 10/11 settings). Select "Safe Mode with Networking" from the Advanced Boot Options. This loads Windows with minimal drivers and prevents most malware from auto-starting, though sophisticated variants may have Safe Mode persistence. The networking component is necessary for later steps where you'll need to download tools or updates.
Identify and terminate suspicious processes
Open Task Manager (Ctrl+Shift+Esc) and examine running processes. Look for executables with system-sounding names (svchost.exe, winlogon.exe, system32.exe) running from unusual locations—legitimate Windows system files run from C:\Windows\System32, not from AppData or Temp folders. Right-click suspicious processes, select "Open File Location" to verify the path, then terminate them. Document process names and locations for later investigation.
Remove registry persistence entries
Press Windows+R, type "regedit", and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the equivalent HKEY_LOCAL_MACHINE path. Look for entries pointing to executables in suspicious locations identified in step 3. Right-click and delete these entries. Also check the RunOnce keys in both hives, and examine HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Services for unfamiliar service entries. Export the registry before making changes so you can restore if something breaks.
Delete malicious files from disk
Navigate to the file locations you documented (typically in AppData\Local\Temp, AppData\Roaming, or ProgramData folders). Delete the suspicious executables. You may need to take ownership of files or boot from a Linux live USB if Windows file protection prevents deletion. Search for files created or modified around the same date as the known malicious files—SystemBC often drops multiple components. Check your user Temp folder, Windows Temp folder, and ProgramData for recently created subdirectories with generic names.
Scan with multiple security tools
Download and run Malwarebytes (free trial sufficient) and Microsoft Defender Offline. Run full system scans with both—not quick scans. SystemBC's detection rate varies between engines, and the malware frequently arrives with other threats that need removal. If either tool finds additional threats, document them before removal. Sophos HitmanPro is another good third-party option for second opinions. Allow all tools to complete full scans even if this takes hours.
Check scheduled tasks for persistence
Open Task Scheduler (search for it in the Start menu) and examine the Task Scheduler Library. Look for tasks created recently that launch executables from unusual locations or that run with SYSTEM privileges. Legitimate Windows tasks have detailed descriptions and publisher information from Microsoft; malicious tasks often have generic names and no description. Delete suspicious tasks, but be conservative—disabling critical Windows tasks can cause system instability.
Reset network settings and review firewall rules
SystemBC may have modified Windows Firewall rules to allow its traffic. Open Windows Defender Firewall with Advanced Security and review inbound/outbound rules for unfamiliar entries, particularly those allowing executables from non-system locations. Delete suspicious rules. Then open an elevated Command Prompt and run "netsh winsock reset" followed by "netsh int ip reset" to clear any proxy settings or network modifications the malware made. Restart the computer after these commands.
Change all passwords from a clean device
Do not change passwords from the infected machine—use your phone, tablet, or another computer. Change passwords for all accounts accessed from the compromised system, prioritizing email, banking, and administrative accounts. Enable multi-factor authentication wherever possible. If this was a business computer with domain credentials, notify your IT department immediately—domain passwords must be reset through proper channels, and the entire network may require investigation.
Monitor for re-infection and behavioral anomalies
After reconnecting to your network, watch for signs of persistent infection over the next week: unexpected network activity, unfamiliar processes appearing in Task Manager, system performance degradation, or security software being disabled. Enable Windows Defender's real-time protection and keep it updated. SystemBC infections frequently indicate broader compromise—if this is a business environment, professional incident response is strongly recommended regardless of whether these steps appear successful.
Prevention
- Maintain rigorous email security practices. Since SystemBC typically arrives via banking trojans distributed through phishing, train yourself and employees to scrutinize unexpected emails, never enable macros in Office documents from unknown senders, and verify requests for sensitive actions through separate communication channels. Implement email filtering that blocks executable attachments and scans links in real-time.
- Secure and monitor Remote Desktop Protocol access. If you must expose RDP to the internet, use a VPN gateway, implement account lockout policies after failed login attempts, require complex passwords or certificate-based authentication, and change RDP to a non-standard port. Better yet, disable RDP entirely for internet-facing systems and use alternative remote access solutions with built-in security controls.
- Keep all software current with security patches. SystemBC operations often exploit weeks- or months-old vulnerabilities in Windows, Office, browsers, and plugins. Enable automatic updates for Windows and all applications, prioritize security patches over feature updates if deployment resources are limited, and inventory your software to identify unsupported products that no longer receive updates. Legacy systems require network isolation or replacement.
- Deploy endpoint detection and response (EDR) solutions. Traditional antivirus struggles with SystemBC's encrypted communications and memory-only payloads. EDR tools monitor behavioral patterns—unusual process hierarchies, suspicious registry modifications, abnormal network connections—that indicate compromise even when signature-based detection fails. For businesses, this is non-negotiable; for home users, Windows Defender with all features enabled provides basic behavioral detection.
- Implement network segmentation and monitoring. SystemBC's value lies in lateral movement and data exfiltration. Segment your network so that a compromise of one system doesn't grant access to everything—separate guest Wi-Fi from internal resources, isolate critical servers behind additional authentication, and monitor east-west traffic between network segments for anomalies. Deploy DNS filtering to block known C2 infrastructure.
- Practice the principle of least privilege. Users and processes should operate with minimum necessary permissions. Don't run daily tasks with administrator rights, restrict which accounts can install software or modify system settings, and use separate accounts for administrative functions versus routine work. This limits malware's ability to achieve persistence or escalate privileges when initial compromise occurs.
- Maintain offline, immutable backups. SystemBC frequently precedes ransomware—its presence often means attackers are preparing for encryption. Keep backups disconnected from your network or in immutable cloud storage that attackers can't delete or encrypt. Test restoration procedures quarterly so you know they work when you need them. For businesses, implement the 3-2-1 rule: three copies, two different media types, one offsite.
- Conduct regular security awareness training. The most sophisticated defenses fail when users click malicious links or provide credentials to phishing sites. Schedule quarterly training that covers current threat scenarios, test employees with simulated phishing campaigns, and create a culture where reporting suspicious activity is encouraged and easy. Make security everyone's responsibility, not just IT's problem.
Bring It In
SystemBC infections rarely travel alone, and the stakes are higher than with typical malware. If this proxy toolkit is on your system, professional attackers likely have or had access to your files, passwords, and network. For businesses, the implications extend to regulatory compliance, customer data protection, and potential liability if the compromise led to broader breaches. Even home users face serious risks—attackers may have accessed tax documents, financial records, or personal communications during their reconnaissance phase. Manual cleanup can miss hidden persistence mechanisms or secondary payloads that re-establish the infection days or weeks later.
Our Roswell location at 1000 Alpharetta Street has the tools and experience to properly investigate and remediate complex infections like SystemBC. We'll examine your system for all components of the infection, verify complete removal with multiple scanning engines, check for evidence of data exfiltration or credential theft, and provide specific recommendations based on what we find. Whether you're a Roswell homeowner with a compromised personal computer or a local business dealing with a potential network breach, we're here to help. Call us at (770) 674-0234 or stop by Monday through Saturday. We offer free diagnostics, transparent pricing before we start work, and same-day service for most malware removals. Don't let attackers maintain their foothold—bring your system in and let's close the door they opened.