Systembc

Malware updated 3 days ago (2024-10-23T04:01:01.558Z)

Download STIX

Preview STIX

SystemBC is a type of malware that has been heavily utilized in various cyber attacks, including those involving the BlackBasta ransomware group in 2023. The Play ransomware actors have also been known to use SystemBC alongside other command and control (C2) applications such as Cobalt Strike and tools like PsExec for lateral movement and file execution. In addition to stealing sensitive data, another malware called Vidar can deliver secondary payloads such as the SystemBC proxy malware. Emails with SystemBC hacktool were detected as compressed attachments in incidents #9437 and #9436. Between May 27 and 29, 2024, an international law enforcement operation coordinated by Europol, codenamed Operation Endgame, targeted malware droppers like IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot. Moreover, backdoor malware like SystemBC, PortStarter, and Supper have also been observed being used in cyber attacks. Trend Micro MDR was alerted to a breach via Vision One Workbench alerts following the detection of a command-and-control tool identified as SYSTEMBC through the Apex One Endpoint Protection Platform (EPP) agent. The original SystemBC file is encrypted with an XOR key, which is exposed due to the encryption of padding null bytes between PE sections. The SystemBC payload in update8.exe is dynamically retrieved from an encrypted resource and directly injected into a child process with the same name. Attackers have used various payloads named to align with their initial lure, including SystemBC malware, Golang HTTP beacons, and Socks proxy beacons. Rapid7 researchers uncovered a new social engineering campaign distributing the SystemBC dropper to the Black Basta ransomware operation.

Description last updated: 2024-10-22T17:42:24.631Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Droxidat is a possible alias for Systembc. DroxiDat, a new variant of the SystemBC malware, was deployed in a series of attacks on critical infrastructure targets in Africa during the third and fourth weeks of March. The malware, which acts as a system profiler and simple SOCKS5-capable bot, was specifically detected at an electric utility c	4
Coroxy is a possible alias for Systembc. Coroxy is a multifaceted malware, also known as SystemBC, DroxiDat, or Proxy, that serves as a backdoor and remote access tool (RAT), adapting to the requirements of attackers. It has been associated with the Play ransomware group, and its infection chain includes various tools such as PsExec, NetSc	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Trojan

Ransomware

Backdoor

Windows

Proxy

Cobalt Strike

Payload

Rat

Loader

Lateral Move...

Tool

Remcos

Phishing

Linux

Reconnaissance

Esxi

Maas

Bot

Beacon

Exploit

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Smokeloader Malware is associated with Systembc. SmokeLoader is a malicious software (malware) used by threat actors to infect systems and exfiltrate data. It operates in conjunction with other open-source tools like Cobalt Strike and Bloodhound, but most notably with Phobos ransomware. Threat actors often use SmokeLoader as a hidden payload in sp	Unspecified	3
The Hijackloader Malware is associated with Systembc. HijackLoader is a new and rapidly growing malware in the cybercrime community, designed to exploit and damage computer systems. This malicious software infects systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once infiltrated, HijackLoader can steal personal	Unspecified	2
The IcedID Malware is associated with Systembc. IcedID is a prominent malware that has been utilized in various cyber-attacks. It functions as a malicious software designed to infiltrate and damage computer systems, often through suspicious downloads, emails, or websites. Once inside a system, IcedID can steal personal information, disrupt operat	Unspecified	2
The Pikabot Malware is associated with Systembc. Pikabot is a type of malware that serves as a trojan, providing initial access to infected computers. This enables the execution of ransomware deployments, remote takeovers, and data theft. It is part of a wider array of malicious software, including IcedID, Qakbot, Gozi, DarkGate, AsyncRAT, JinxLoa	Unspecified	2
The Black Basta Malware is associated with Systembc. Black Basta is a notorious malware and ransomware group known for its high-profile attacks on various sectors. The group, also known as Storm-0506, has been active since at least early 2022 and has accumulated over $107 million in Bitcoin ransom payments. It deploys malicious software to exploit vul	Unspecified	2
The Vidar Malware is associated with Systembc. Vidar is a Windows-based malware, written in C++, that primarily functions as an infostealer. It is based on the Arkei stealer and typically targets various types of data, using the ACR Stealer as an exfiltration module. However, in a unique twist, Vidar downloads the ACR stealer instead of stealing	Unspecified	2
The Redline Stealer Malware is associated with Systembc. RedLine Stealer is a type of malware, or malicious software, that infiltrates computer systems with the intent to exploit and cause damage. It typically gains access through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside the system, it can steal personal i	Unspecified	2
The Amadey Malware is associated with Systembc. Amadey is a form of malware, a malicious software designed to exploit and damage computer systems. This particular malware is distributed via the Amadey loader, which can be disseminated through phishing emails or downloads from compromised sites. It has been observed that the individual behind the	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Pistachio Tempest Threat Actor is associated with Systembc. Pistachio Tempest, also known as FIN12, is a threat actor that has been identified as a significant cybersecurity risk, particularly to the healthcare industry. According to a report by the U.S. Department of Health and Human Services (HHS) in 2022, this group has specifically targeted healthcare en	Unspecified	2
The Rhysida Threat Actor is associated with Systembc. Rhysida, a threat actor active since May 2023, has been responsible for numerous high-profile ransomware attacks. The group is known for its use of various ransomware families, including BlackCat, Hello Kitty, Quantum Locker, Rhysida, Zeppelin, and its own eponymous program, to aid in double extorti	Unspecified	2
The Vice Society Threat Actor is associated with Systembc. Vice Society, a threat actor or hacking team with malicious intent, has been active since 2022 and has made significant waves in the cybersecurity world. The group is known for deploying various forms of ransomware, including BlackCat, Quantum Locker, Zeppelin, and their own branded variant of Zeppe	Unspecified	2
The FIN12 Threat Actor is associated with Systembc. FIN12, also known as DEV-0237 and Pistachio Tempest, is a threat actor group notorious for its malicious cyber activities. Tracked by Microsoft, this group is primarily engaged in the distribution of Hive, Conti, and Ryuk ransomware. The group has been responsible for several high-profile ransomware	Unspecified	2

Source Document References

Information about the Systembc Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
Securityaffairs	3 days ago	Experts warn of a new wave of Bumblebee malware attacks
BankInfoSecurity	a month ago	'Vanilla Tempest' Now Using INC Ransomware in Health Sector
Trend Micro	2 months ago	How Trend Micro Managed Detection and Response Pressed Pause on a Play Ransomware Attack
Securityaffairs	2 months ago	Security Affairs newsletter Round 485 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	2 months ago	Black Basta ransomware gang linked to a malware campaign
Securityaffairs	5 months ago	Operation Endgame, the largest law enforcement operation ever against botnets
DARKReading	7 months ago	Hackers Posing as Law Firms Phish Global Orgs
CrowdStrike	7 months ago	The Anatomy of an ALPHA SPIDER Ransomware Attack
CERT-EU	8 months ago	Cyber Security Week in Review: March 1, 2024
CERT-EU	8 months ago	The Anatomy of an ALPHA SPIDER Ransomware Attack \| #ransomware \| #cybercrime \| National Cyber Security Consulting
Securityaffairs	8 months ago	IDAT Loader used to infect a Ukraine entity in Finland with Remcos RAT
CERT-EU	9 months ago	JinxLoader Malware: Next-Stage Payload Threats Revealed
CERT-EU	9 months ago	The Top 10 Ransomware Groups of 2023
CERT-EU	10 months ago	New JinxLoader Targeting Users with Formbook and XLoader Malware \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
Malwarebytes	10 months ago	Ransomware review: December 2023
CISA	10 months ago	#StopRansomware: Play Ransomware \| CISA
CERT-EU	10 months ago	Play Ransomware: SafeBreach Coverage for US-CERT Alert (AA23-352A)
Securelist	a year ago	Kaspersky malware report for Q3 2023
CERT-EU	a year ago	Same threats, different ransomware
CERT-EU	a year ago	SystemBC, a SWISS KNIFE Proxy Malware, Used by Numerous Ransomware Groups