SystemBC: Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "GNU C Compiler (MinGW GCC) / Microsoft Visual C++",
  "runtime": "Native Win32 Winsock API (ws2_32.dll) without external runtime dependencies",
  "binary_footprint": "Ultra-compact standalone executable (typ. 45 KB - 85 KB), engineered for low-profile execution",
  "stub_size": "49,152 bytes typical compiled PE footprint",
  "packer_obfuscation": "Frequently unpacked or protected with basic UPX, custom XOR loops, and string encryption",
  "subsystem": "Windows Console / Windows GUI (Subsystem 2 or 3)",
  "entry_point_flow": "main() -> WSAStartup() -> Decrypt embedded config struct -> Spawn worker threads -> Thread 1: Heartbeat & command execution loop -> Thread 2: Establish reverse TCP tunnel -> SOCKS5 negotiation loop -> Relay internal network traffic to C2",
  "technical_summary": "SystemBC is a headless, lightweight C-based proxy bot and back-connect tunnel utility widely deployed by ransomware operators (including DarkSide, BlackCat/ALPHV, LockBit, and REvil) for lateral movement and covert network pivoting. It features a custom mini-Tor client implementation capable of routing encrypted traffic directly to .onion hidden services without installing standard Tor software, alongside standard SOCKS5 reverse tunneling and remote cmd.exe execution capabilities."
}

{
  "interface_type": "Headless C Daemon / Operator Terminal Console",
  "builder_tabs_options": [],
  "config_struct_layout": [
    {
      "offset": "0x00",
      "field": "c2_ip_or_onion",
      "type": "Char Array [128]",
      "description": "Hardcoded C2 IP address or Tor .onion hidden service domain"
    },
    {
      "offset": "0x80",
      "field": "c2_port",
      "type": "uint16_t",
      "description": "Port number for command and proxy tunneling (e.g., 4001, 4014, 4028, 5001)"
    },
    {
      "offset": "0x82",
      "field": "tor_flag",
      "type": "uint16_t",
      "description": "Boolean switch (0 = direct TCP, 1 = route via embedded mini-Tor protocol)"
    },
    {
      "offset": "0x84",
      "field": "heartbeat_interval",
      "type": "uint32_t",
      "description": "Interval in seconds between active heartbeat keep-alive beacons"
    },
    {
      "offset": "0x88",
      "field": "rc4_key",
      "type": "Byte Array [32]",
      "description": "Symmetric encryption key used to encrypt binary command frames"
    },
    {
      "offset": "0xA8",
      "field": "service_name",
      "type": "Char Array [64]",
      "description": "Windows Service name registered for system persistence"
    }
  ],
  "payload_generation_flags": [
    "Target Platform: Windows x86/x64 Native",
    "Tor Client: Enabled (Embedded Mini-Tor)",
    "SOCKS5 Proxy: Reverse Back-Connect",
    "Command Execution: cmd.exe pipe enabled"
  ],
  "operator_commands": [
    "CMD_SOCKS5_CONNECT: Establish reverse SOCKS5 tunnel connection to specified internal IP:Port",
    "CMD_EXEC_SHELL: Execute arbitrary Windows terminal commands via cmd.exe /c redirection",
    "CMD_DOWNLOAD_EXEC: Download binary from remote URL to %TEMP% and execute via CreateProcessA",
    "CMD_TERMINATE: Gracefully close active tunnels and terminate daemon process"
  ],
  "interface_telemetry_analysis": "SystemBC operates headlessly without a graphical operator builder interface. Configuration parameters are embedded directly into source headers or patched into the binary prior to deployment. Operators interact with deployed bots via centralized proxy handler scripts written in Python or C that accept incoming SOCKS5 tunnel connections and expose local listening ports."
}

struct SystemBC_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Execution as standalone service or dropped binary: Decrypts embedded C2 IP and port -> Creates Winsock socket -> Initiates outbound TCP connection to C2 -> Establishes SOCKS5 proxy protocol handshake -> Relays raw TCP packets between remote operator and target enterprise intranet machines (e.g., RDP port 3389, SMB port 445, LDAP port 389) -> Executes cmd.exe /c upon specific operator command flags.",
  "ntapi_functions": [
    "ws2_32!WSAStartup",
    "ws2_32!socket",
    "ws2_32!connect",
    "ws2_32!send",
    "ws2_32!recv",
    "ws2_32!select",
    "ws2_32!closesocket",
    "kernel32!CreateThread",
    "kernel32!CreateProcessA",
    "advapi32!CreateServiceA",
    "advapi32!OpenSCManagerA"
  ],
  "process_hollowing_target": "None (executes as a background service or standalone process; executes child cmd.exe for shell commands)",
  "persistence_mechanics": [
    "Windows Service: Creates service via advapi32!CreateServiceA with SERVICE_AUTO_START configuration",
    "Scheduled Task: schtasks.exe /create /tn \"SystemBC\" /tr \"<Path_To_Binary>\" /sc onstart",
    "Registry Run Key: HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemBC"
  ],
  "evasion_hooks": [
    "Mini-Tor Protocol: Implements a stripped-down Tor protocol stack capable of establishing one-hop Tor circuits over raw TCP sockets without needing external tor.exe or DLLs, bypassing domain reputation filters.",
    "Traffic Encryption: Encrypts packet framing with RC4 stream cipher, masking SOCKS5 protocol indicators from basic network protocol decoders.",
    "Minimal API Footprint: Uses standard Winsock APIs without triggering behavioral heuristic flags typical of complex malware loaders."
  ],
  "anti_analysis": [
    "Process Renaming: Masquerades as legitimate Windows service executables (e.g. svchost.exe, taskhost.exe, rundll32.exe).",
    "Low Overhead: Operates without GUI windows or aggressive disk read/write actions, maintaining an extremely low endpoint telemetry profile."
  ]
}

Concrete technical breakdown of functional modules implemented in the SystemBC binary:

{
  "framing": "Custom binary packet framing prefixed by command byte and length indicators, followed by RC4-encrypted SOCKS5 data streams",
  "serialization": "Raw binary struct serialization adhering to RFC 1928 SOCKS5 specification",
  "handshake": "Client opens TCP connection to C2 -> Transmits 32-byte authentication beacon (contains bot ID and OS version encrypted with RC4) -> C2 responds with session acknowledgement -> Enters reverse SOCKS5 proxy relay mode",
  "cryptography": "RC4 stream cipher with static key; optional Tor protocol encryption wrapping packets destined for .onion hidden services",
  "packet_types": [
    {
      "header": "0x01 [Auth Beacon]",
      "payload": "Bot ID [16 bytes], OS Version [4 bytes], Flag [2 bytes] (RC4 Encrypted)",
      "direction": "Client -> Server"
    },
    {
      "header": "0x02 [SOCKS5 Connect]",
      "payload": "Target IP [4 bytes], Target Port [2 bytes] (RFC 1928 format)",
      "direction": "Server -> Client"
    },
    {
      "header": "0x03 [SOCKS5 Data Relay]",
      "payload": "Raw TCP payload stream proxied between C2 and internal network endpoint",
      "direction": "Bidirectional"
    },
    {
      "header": "0x04 [Shell Command]",
      "payload": "Length-prefixed ASCII command string to execute via cmd.exe /c",
      "direction": "Server -> Client"
    }
  ],
  "traffic_signature": "Continuous TCP stream over custom ports (e.g. 4001, 5001) or TLS port 443 with high entropy; bidirectional data transfer resembling internal SMB, RDP, or LDAP protocol flows wrapped in RC4."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: