Threat video1:00
SystemBC DroxiDat Multi-Purpose Proxy: Detection & IOCs
SystemBC turns infected Windows hosts into SOCKS5 and Tor proxies. 9 detection rules, 36 IOCs, 29 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for SystemBC DroxiDat Multi-Purpose Proxy: Detection & IOCs →
Chapters
- 0:00The hookSystemBC backs 11 ransomware families.
- 0:04The storyEstablishes persistence on systems.
- 0:10Attack pathExploit kits deliver it; checks for Emsisoft.
- 0:24AttributionAttributed to Periwinkle Tempest.
- 0:29Indicators of compromise31 indicators to hunt: 7 IPs, 4 domains and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques29 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation12 remediation steps are listed, 6 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SystemBC backs 11 ransomware families.
0:05Establishes persistence on systems.
0:07Proxies ransomware C2 traffic.
0:11Exploit kits deliver it; checks for Emsisoft.
0:14Creates registry and task persistence.
0:17Sends encrypted beacon, executes commands.
0:20Routes C2 via SOCKS5 and Tor.
0:25Attributed to Periwinkle Tempest. Confidence: low.
0:2931 indicators to hunt: 7 IPs, 4 domains and 3 SHA-256 hashes, and more.
0:3829 ATT&CK techniques, from initial access to command and control.
0:4412 remediation steps are listed, 6 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.