SystemBC Self-Copy Executable Dropped into ProgramData Subdirectory

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects the creation of executable files within the C:\ProgramData\ directory initiated by common command-line interpreters (cmd.exe, powershell.exe, wscript.exe, svchost.exe). This pattern is often indicative of the SystemBC backdoor or similar malware attempting to drop its executable payload in a non-standard, persistent location to evade initial detection.