10KB SystemBC Dropper Evades Both Sandboxes in Saudi Telecom Attack

##A 10-Kilobyte Ghost: How a Zero-Import SystemBC Dropper Defeated Every Sandbox Targeting Saudi Telecom

A single 10-kilobyte unsigned Windows executable — compact enough to fit inside a typical email attachment header — has been identified in a campaign against telecommunications infrastructure in Saudi Arabia, carrying a technical profile that exposes a deliberate gap in how most enterprise detection pipelines are built. The file, SHA-256 46af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa, is a SystemBC/Coroxy proxy-RAT dropper that 62 of 76 antivirus engines correctly flag on static analysis — yet both automated sandboxes that processed it returned clean verdicts. That divergence is not an accident. It is the operational point of the exercise.

CTX Team's analysis of this artefact, attributed to the actor tracked as DragonForce (also known as DragonForce Malaysia), maps a tightly constructed evasion chain: timing-based sandbox defeat [T1497.003], zero-import-table obfuscation, Registry-based persistence [T1547.001], and command-and-control tunnelled over non-standard ports [T1571] to a freshly provisioned bullet-proof hosting node in ASN 215730 — a Russian-addressed provider geolocated to Germany with no prior VirusTotal reputation. The campaign's overall confidence score sits at a low-to-medium threshold given the narrow two-IOC evidence base, but the tradecraft signals embedded in those two indicators are analytically rich and warrant close attention from defenders operating in the Gulf telecommunications sector.

---

The Static-Dynamic Detection Gap as an Intentional Weapon

The most operationally significant fact about this dropper is not what it does — it is what it does not trigger. When the binary was submitted to VirusTotal in October 2023, 62 of 76 antivirus engines returned malicious verdicts on static analysis. The file's threat label resolves consistently across the engine population as trojan.coroxy/boigy, with popular name variants including coroxy, boigy, and garvi — all aliases for the SystemBC proxy-RAT family. The ditekSHen YARA rule MALWARE_Win_EXEPWSH_DLAgent, described as "Detects SystemBC," fires twice on the binary, indicating the rule matches against multiple distinct byte sequences within the same file rather than a single signature hit. Two medium-severity Sigma rules also match. By any static-analysis measure, this is a well-characterised, widely detected malware sample.

Yet both automated sandboxes that executed the file — C2AE and SecondWrite — returned non-malicious verdicts. C2AE classified the sample as UNKNOWN_VERDICT; SecondWrite returned CLEAN. Zero of two sandboxes reached a malicious conclusion.

This outcome is explained directly by the file's own tags: detect-debug-environment and long-sleeps. These map precisely to MITRE T1497.003 — time-based checks — a technique in which adversaries use calls such as GetTickCount or GetSystemTimeAsFileTime to measure elapsed time and detect whether the execution environment is a sandbox accelerating the clock. If the measured elapsed time after a sleep call is shorter than the expected real-world interval, the binary infers it is running inside an instrumented environment and withholds its malicious behaviour. The long-sleeps tag reinforces this: the binary is designed to sleep for intervals long enough that most sandbox time-budget limits expire before the payload activates. The result is operationally confirmed by the sandbox consensus — the evasion works.

This is not a novel technique in isolation. What makes the implementation here notable is its combination with a second structural anomaly: the binary carries zero import-table entries (import_count=0). For a PE32 executable, an empty import table is architecturally unusual. Standard Windows executables reference at minimum a handful of Windows API functions through the import address table; a zero-entry import table suggests either that the binary resolves all API calls dynamically at runtime — a common anti-analysis technique that defeats import-hash clustering — or that this is a custom loader stub whose primary function is to unpack and execute a second stage rather than operate as a full-featured implant. CTX Team assesses this as possible import-table obfuscation or a purpose-built dropper stub, consistent with the binary's unusually small footprint.

The PE sections support the stripped-down interpretation. The .text section, which carries the executable code, registers an entropy of 5.99 across 6,656 bytes — elevated relative to uncompressed code but below the 7.0-plus threshold typically associated with strong packing. The .rdata section sits at 3.95 entropy across 2,048 bytes, and .data at 4.97 across 512 bytes. The overall profile is consistent with a lightly obfuscated or selectively compressed binary rather than a heavily packed payload. The imphash resolves to d66000edfed0a9938162b2b453ffa516, though given the zero-import anomaly, this hash carries limited clustering value — a zero-entry import table produces a degenerate imphash that does not meaningfully fingerprint the builder toolchain.

One additional tag on the file warrants noting: cve-2005-0446, accompanied by the exploit tag. This CVE references a vulnerability in Squid proxy's DNS PTR record handling — a detail that connects directly to the IDS rule hit discussed in the C2 section below. No exploit payload is directly confirmed, but the co-occurrence of the CVE tag with the IDS rule match is not coincidental.

The file carries no code-signing certificate. It is entirely unsigned. Any analytical framing that invokes supply-chain or signed-binary abuse must be set aside for this campaign; the dropper relies on evasion technique rather than certificate trust to bypass defences.

---

A Bullet-Proof Hosting Node With No Prior History

The sole network indicator associated with this campaign is the IP address 77.91.124.71, and its infrastructure profile is as deliberately minimal as the dropper itself.

The address sits within the /24 block 77.91.124.0/24, assigned to a narrow four-address allocation — 77.91.124.68 through 77.91.124.71 — registered under RIPE NCC with the netname NET-NAME-ID-1722. The organisation record, ORG-YA166-RIPE, identifies the operator as YeezyHost Hosting, with a physical address listed as Pushkina 11, 634003, Tomsk, Russia. The maintainer handle is yeezyhost-mnt, and the RIPE record for both the organisation and the specific address block was created on 2023-05-10 — roughly five months before the dropper's first VirusTotal submission on 2023-10-17 and eight days before the PE timestamp of 2023-10-09. The infrastructure was provisioned well in advance of the campaign's observable activity window.

Despite the Russian organisational address, the IP geolocation resolves to Germany (EU, RIPE NCC region). This geographic mismatch — Russian-registered operator, European-geolocated endpoint — is a characteristic pattern of bullet-proof hosting providers that route traffic through European data-centre capacity to reduce abuse-report friction and complicate jurisdiction-based blocking. The autonomous system number is 215730, assigned to H2nexus Ltd. CTX Team's analysis flags ASN 215730 as a unique-ASN outlier: it appears on no other indicator, making this a single-point infrastructure anchor with no lateral expansion available from the current evidence base.

The IP carries 0 of 91 VirusTotal detections and zero community votes — neither malicious nor harmless. It has not been flagged in any threat-intelligence sharing pipeline visible to VirusTotal's engine population. This clean reputation is an operational asset: defenders relying on IP reputation feeds to gate traffic will find no pre-existing signal to act on. Using a bare IP directly as C2 with no domain layer leaves no certificate or registration trail, frustrating infrastructure tracking. The C2 node is, by design, a dead end for infrastructure-based hunting beyond the /24 block itself.

The linkage between the file and this IP is inferred from campaign context rather than direct sandbox network telemetry — no sandbox execution of the dropper produced a confirmed outbound connection to 77.91.124.71. The association is analytically sound given the co-attribution within the same threat record, but defenders should treat the file-to-IP binding as a medium-confidence inference rather than a directly observed network event.

The timing alignment between the YeezyHost block's creation date (2023-05-10), the dropper's PE compile timestamp (2023-10-09), and its first submission (2023-10-17) suggests a deliberate staging sequence: infrastructure provisioned months in advance, payload compiled approximately a week before deployment, and the sample appearing in VirusTotal within days of that compilation. This is consistent with a pre-planned operation rather than opportunistic tooling reuse.

---

Execution to Persistence: The Dropper's Operational Chain

Walking the attack chain from the available evidence, the campaign's observable sequence begins at execution. The dropper's alternate-name paths recorded in VirusTotal telemetry show the binary landing in the victim's user Temp directory under randomised filenames: C:\Users\user\AppData\Local\Temp\54F2.exe, C:\Users\user\AppData\Local\Temp\52FE.exe, and paths rooted in randomised extensions including .aex and .toc containers. The specific paths C:\Users\user\AppData\Local\Temp\j43jpwgj.aex\dest\ and C:\Users\user\AppData\Local\Temp\10p3uwhj.toc\395e28e36c665acf5f85f7c4c6363296 indicate the binary was unpacked or dropped from an archive-style container with a randomised name, a pattern consistent with second-stage delivery from a loader or a phishing document that extracts and executes a payload from a temporary archive. The initial-access vector is not directly evidenced and should be treated as inferred — the execution context is established, but not the delivery mechanism that preceded it.

The binary's first evasion move, as described above, is temporal. Before any malicious activity, the sample checks whether it is running inside a sandbox or debugger [T1497.003]. The detect-debug-environment tag indicates active probing of the execution environment — checking for debugger presence, virtual machine artefacts, or instrumentation hooks — while long-sleeps implements the timing-based variant: sleeping long enough to exhaust sandbox execution budgets. The security-tool disablement signal [T1562.001] in the threat metadata extends this further, indicating the sample also attempts to probe and neutralise defensive instrumentation it encounters. The combination of environment detection and tool disablement represents a layered approach to defeating both automated analysis and live endpoint monitoring.

Once the binary determines it is running in a genuine user environment, persistence is established through Registry Run Key installation [T1547.001]. SystemBC's documented behaviour includes writing entries to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run or its HKLM equivalent, ensuring the proxy-RAT re-executes on every user logon. The file's persistence tag and the presence of both T1547 and T1547.001 in the threat metadata confirm this mechanism. Alongside the run-key installation, the sample modifies additional Registry values [T1112] — a technique that MITRE documents as serving to hide configuration information or impair defences, consistent with the T1562.001 signal and the sample's broader pattern of neutralising the host's defensive posture before establishing its C2 foothold.

The C2 stage is where SystemBC's core function activates. The family operates as a SOCKS5 proxy tunnel, enabling operators to route additional payloads and C2 traffic through the compromised host while obscuring the true origin of that traffic. Communication is conducted over non-standard ports [T1571] — a technique MITRE describes as using protocol-port pairings not typically associated with each other, such as HTTPS over port 8088, to bypass filtering and muddle network analysis. The inferred C2 endpoint is 77.91.124.71 on ASN 215730.

The IDS rule hit on the dropper — PROTOCOL-DNS squid proxy dns PTR record response denial of service attempt from the Snort registered user ruleset — provides an additional layer of signal at the C2 layer. This rule fires on DNS PTR record responses associated with Squid proxy behaviour, and its co-occurrence with the cve-2005-0446 tag on the same binary is analytically significant. CVE-2005-0446 is a vulnerability in Squid's handling of DNS PTR responses that can be exploited to cause a denial-of-service condition. The presence of both the CVE tag and the matching IDS rule on the same sample suggests the dropper may be probing or exploiting Squid proxy infrastructure as part of its C2 routing mechanism — consistent with SystemBC's design as a proxy-RAT that leverages existing proxy infrastructure to tunnel traffic. This connection is assessed at medium confidence; no exploit payload is directly confirmed, but the co-occurrence is not coincidental and warrants further investigation.

The YARA rule MALWARE_Win_EXEPWSH_DLAgent fires twice on the binary. As CTX Team's cohort analysis notes, both hits resolve to the same SHA-256 — this reflects the rule matching against two distinct byte sequences within the single file rather than a true multi-sample cohort. The double-fire is analytically interesting as a signal of the rule's breadth across the binary's byte content, but it does not imply a second distinct sample exists in the current evidence base.

---

DragonForce's Targeting Logic and the Telecommunications Sector

The campaign is attributed to DragonForce, also tracked under the alias DragonForce Malaysia. The actor's alignment is assessed as cybercriminal-other in the structured threat record, though the stated motivation — espionage — and the targeting of telecommunications infrastructure in Saudi Arabia introduce a pattern that is worth examining carefully.

The espionage motivation and telecom targeting combination is significant regardless of the actor's formal classification. Telecommunications carriers in Saudi Arabia occupy a position of exceptional intelligence value: they route communications data for government, military, commercial, and diplomatic traffic across the Gulf region, and their network infrastructure provides potential access to routing tables, subscriber metadata, and real-time communications flows. A proxy-RAT like SystemBC, designed to tunnel additional payloads through compromised hosts, is well-suited to establishing persistent access that can be leveraged for long-term intelligence collection — or for positioning additional tooling deeper into carrier infrastructure — rather than for the rapid monetisation typical of financially motivated intrusions.

Whether this campaign reflects state-adjacent tasking, a hacktivist group operating beyond its traditional profile, or a criminal actor selling access to a downstream buyer with intelligence objectives is not determinable from the current evidence base. The alignment confidence is assessed as low, and no public reporting with confirmed attribution to state sponsorship is available. The pattern is consistent with intelligence-collection objectives, but that consistency alone does not establish the actor's ultimate handler. Analysts should treat the espionage-motivation tag as a targeting-pattern descriptor rather than a confirmed operational mandate.

No historical arc claims or prior named campaigns are available for this specific DragonForce operation, and CTX Team will not fabricate a campaign lineage where the evidence base does not support one. The current evidence is too thin to conclude a broader campaign lineage — one file, one IP — and the narrow two-IOC footprint limits retrospective visibility for this cluster.

---

What the Zero-Import Anomaly Signals About Operational Maturity

The structural profile of this dropper — 10KB, unsigned, zero imports, timing-based sandbox evasion, single-IP C2 with no domain or certificate anchor — reads as a deliberate minimisation strategy rather than a capability limitation. Each design choice reduces the attack surface available to defenders and analysts.

Zero import entries eliminate import-hash clustering as a detection pivot. An unsigned binary removes certificate-serial pivoting and code-signing reputation as detection vectors. A sub-11KB footprint reduces the binary's entropy profile and makes it less visually anomalous in process listings or file-system scans. Timing-based sandbox evasion defeats the automated dynamic analysis layer that many enterprise detection pipelines treat as their primary behavioural signal. A freshly provisioned, reputation-clean C2 IP with no associated domains eliminates network-reputation blocking and domain-based threat-intelligence feeds as response mechanisms. Using a bare IP with no domain or certificate anchor means there is no lateral pivot available from the network side of the equation.

The result is a payload that is simultaneously well-known to static antivirus engines — 62 of 76 flag it — and effectively invisible to the automated dynamic analysis layer that enterprise security operations increasingly rely on for behavioural confirmation before escalating an alert. The static detection rate is high enough that any organisation running a modern AV stack on their endpoints would catch this binary at the file-write stage. But an organisation whose detection pipeline routes suspicious files through sandbox analysis before triggering a response — and whose sandbox infrastructure does not account for timing-based evasion — would see the sandbox return clean and potentially deprioritise the alert.

The imphash d66000edfed0a9938162b2b453ffa516 is recorded in the build provenance, but as noted above, its clustering value is limited by the zero-import anomaly. The vhash 014046551d551088z157z35z25z15z37z and ssdeep 192:F8fzqMmTL+f6eeAY82mNZRZ1eLP/x1fkNvFCDko:F8GMmv+f6eX22RZ0LXTsN0ko provide fuzzy-matching anchors for hunting structurally similar samples, and the rich PE header hash cb8bf2a2835f64143aaff9a26fe716c2 offers an additional build-environment fingerprint. The PE compile timestamp of 2023-10-09 and first submission of 2023-10-17 represent an eight-day window between compilation and initial VirusTotal visibility — a tight operational tempo consistent with a targeted deployment rather than broad distribution.

The file was submitted three times from three unique sources between 2023-10-17 and 2023-10-18, a narrow 24-hour submission window. This compressed submission profile, combined with the tight compile-to-submission gap, suggests the sample was encountered in a specific operational context rather than discovered through broad scanning or honeypot telemetry.

---

The Operational Calculus of a Low-Footprint, High-Dwell Strategy

The campaign's design philosophy is legible in its artefacts. The operators chose a tool — SystemBC — whose primary value is not initial exploitation but sustained, low-visibility access. A SOCKS5 proxy-RAT that tunnels traffic through a compromised host does not announce itself through high-volume data exfiltration or noisy lateral movement. It sits, routes, and enables. The additional payloads it tunnels, the reconnaissance it facilitates, and the access it brokers are the operational product; the dropper itself is merely the door.

The choice of YeezyHost (ASN 215730) as the sole C2 anchor reflects the same logic. A Russian-addressed provider registered in April 2023, operating a /24 block provisioned in May 2023, geolocated to Germany, with zero prior VirusTotal reputation and no associated domain infrastructure — this is a node chosen for its absence of history rather than for any positive capability it provides. The four-address allocation (77.91.124.68–71) is narrow enough to suggest dedicated rather than shared hosting, reducing the risk of co-tenant abuse reports triggering a takedown. The maintainer contact, [email protected], is registered to a role handle — Demyanov Vlad Olegovish at the same Tomsk address — that provides a nominal abuse-contact without meaningful accountability.

The divergence between static detection (62/76 AV engines flagging) and dynamic detection (0/2 sandboxes returning malicious) is the campaign's central operational bet. It is a bet that most enterprise detection pipelines will route the file through sandbox analysis before acting on a static AV alert, and that the sandbox will return clean. In environments where sandbox confirmation is required before an alert escalates to a human analyst, this dropper would pass through unexamined. In environments where static AV detection alone triggers immediate quarantine and investigation, the 62/76 detection rate would catch it at the file-write stage.

The broader implication for the telecommunications sector in Saudi Arabia — and for carriers in the Gulf region more generally — is that this campaign is not optimised for speed or volume. It is optimised for dwell time. A SystemBC implant that survives reboots via Registry Run Key persistence [T1547.001], communicates over non-standard ports [T1571] to a reputation-clean IP, and defeats automated sandbox analysis [T1497.003] is designed to remain in place for weeks or months, quietly enabling whatever secondary operations the operators choose to route through it. The sector that will feel the downstream consequences of that access most acutely is not just the carrier itself but every organisation, government entity, and individual whose communications transit the compromised infrastructure.

If this pattern — zero-import dropper, timing-based sandbox evasion, single-IP BPH node with no domain or certificate anchor — proves consistent across additional DragonForce operations, it suggests the actor is making deliberate investments in operational security that specifically target the gaps in automated detection infrastructure. The signature novelty of the payload matters less than the architectural gap it exploits: the assumption, embedded in many enterprise detection pipelines, that a sandbox returning clean is a reliable indicator of safety. This campaign is a direct challenge to that assumption, and the challenge is effective.