# SystemBC (Coroxy / DroxiDat) Malware: Multi-Purpose SOCKS5/Tor Proxy Backdoor Enabling Ransomware Operations

> SystemBC (aka Coroxy, DroxiDat) is a Windows-only backdoor/RAT sold as malware-as-a-service that converts infected hosts into SOCKS5 (and, in newer variants, Tor) proxies to tunnel other malware's C2 traffic and execute arbitrary commands, scripts, and binaries. It has been used as an access/tunneling component alongside numerous ransomware families including Ryuk, Egregor, Maze, MountLocker, Conti, Nokoyawa, BlackBasta, Play, ViceSociety, 8Base, and Rhysida.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1227
- **ID:** TL-2026-1227
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Periwinkle Tempest (Russia)
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SystemBC is a commodity Windows backdoor first documented in 2018 that has evolved into a persistent "Swiss-army-knife" tool in the ransomware ecosystem. It is typically delivered via exploit kits (historically RIG, Fallout) or dropped by loader malware (Emotet, QBot/Qakbot, Buer Loader) after initial compromise, and by threat actors such as Wizard Spider (since 2020) and FIN7 (since 2022), as well as financially motivated intrusion sets tracked as Pistachio Tempest/FIN12.

Once deployed, SystemBC establishes persistence via a Registry Run key (commonly under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, value name "socks5") and/or a scheduled task with a randomly named `.job` file under `C:\Windows\Tasks\`. The malware copies itself into a randomly named subdirectory of `%ProgramData%` and re-registers the copy as a scheduled task invoked with a "start" argument. It performs anti-analysis checks, including skipping persistence installation when Emsisoft's `a2guard.exe` process is detected.

C2 communication begins with a 100-byte beacon: a 50-byte plaintext RC4 key followed by 50 bytes of RC4-encrypted host/user reconnaissance data (machine name, username, IP address, volume serial number). Configuration data is stored/obfuscated in memory using a 40-byte XOR key. The malware supports resolution of `.bit` pseudo-domains via alternate/custom DNS infrastructure (observed using OpenNIC resolvers such as ns1.vic.au.dns.opennic.glue and ns2.vic.au.dns.opennic.glue), and newer variants embed a mini-tor-based Tor client (using Windows BCrypt/CNG cryptographic APIs) to route C2 over the Tor network, hardcoding Tor directory authority IPs (193.23.244.244, 86.59.21.38, 199.58.81.140, 204.13.164.118) to bootstrap circuits without relying on the public Tor consensus fetch. The default C2 listener port is TCP/4001; the SOCKS5 proxy component is advertised on underground forums as supporting configurable ports and up to 40,000 concurrent proxied connections.

SystemBC operates as both a RAT and a loader: it can execute arbitrary EXE, DLL, shellcode, VBS, BAT, CMD, and PowerShell payloads pushed from its operator, including in-memory (reflective) execution to minimize disk artifacts. This lets ransomware affiliates use a single implant for discovery, credential/lateral-movement tooling delivery, and traffic tunneling that evades network-based detection (since ransomware C2/exfil traffic egresses through the compromised host's SOCKS5/Tor tunnel rather than a directly attributable ransomware C2 address).

A closely related lightweight variant tracked as DroxiDat (~8KB) was observed in March 2023 in an intrusion against a healthcare-sector target in southern Africa, functioning purely as a system profiler/lightweight SystemBC client that collected host information and staged a Cobalt Strike beacon from the same infrastructure cluster before the intrusion proceeded toward Nokoyawa ransomware deployment. That incident used a `C:\perflogs\` staging directory and C2 domains with power/energy-industry-themed naming (`powersupportplan[.]com`, `epowersoftware[.]com`), suggesting deliberate blending into critical-infrastructure/utility-sector network traffic; Kaspersky attributed the cluster to Pistachio Tempest/FIN12 with low confidence based on staging-directory reuse and shared Cobalt Strike license IDs across incidents.

SystemBC's persistent value to ransomware affiliates comes from decoupling proxy/tunneling infrastructure from the ransomware payload itself: defenders who block or attribute ransomware C2 domains do not automatically disrupt the SystemBC tunnel, and the SOCKS5/Tor layer can be reused across multiple ransomware deployments and affiliates purchasing the same malware-as-a-service kit.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1053 Scheduled Task/Job
- T1053.005 Scheduled Task
- T1001 Data Obfuscation
- T1678 Delay Execution
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1564.003 Hidden Window
- T1620 Reflective Code Loading
- T1087.001 Local Account
- T1057 Process Discovery
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1071.004 DNS
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1090.003 Multi-hop Proxy
- T1572 Protocol Tunneling
- T1104 Multi-Stage Channels

## Sources

- [SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows](https://www.picussecurity.com/resource/blog/systembc-malware-how-the-coroxy-proxy-backdoor-targets-windows)
- [SystemBC, Software S9001](https://attack.mitre.org/software/S9001/)
- [Focus on DroxiDat/SystemBC](https://securelist.com/focus-on-droxidat-systembc/110302/)
- [SystemBC Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/systembc)
- [Hackers Use SystemBC Malware to Hide C2 Traffic and Maintain Persistent Access](https://cybersecuritynews.com/hackers-use-systembc-malware-to-hide-c2-traffic/)
- [SystemBC (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc)
- [SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks](https://gbhackers.com/systembc-malware-attacks/)
- [Backdoor:Win32/Coroxy.A threat description](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FCoroxy.A&ThreatID=2147766831)
- [The Swiss Knife - SystemBC | Coroxy](https://rexorvc0.com/2023/11/12/Swiss-Knife-SystemBC-Coroxy/)
- [SystemBC](https://hunt.io/malware-families/systembc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1227