Loading malware…
BLOODALCHEMY is a Windows x86 backdoor and remote access trojan associated with the REF5961 intrusion set and assessed as part of China-nexus espionage activity. It has been described as a likely evolutionary descendant of DeedRAT, itself linked by multiple researchers to ShadowPad lineage, based on strong similarities in loader design, custom payload formatting, configuration structure, plugin-related logic, and persistence conventions. BLOODALCHEMY appears to be under active development and has been observed both as shellcode injected into a signed benign process and as a payload loaded through DLL sideloading chains.
In observed intrusions, BLOODALCHEMY was delivered via a sideloading sequence in which a legitimate executable loaded a malicious DLL that decrypted and executed shellcode in memory. The shellcode then restored the BLOODALCHEMY payload from an encrypted and compressed custom format and mapped it for execution. The malware supports multiple run modes that alter behavior, including command-and-control operation, installation, named-pipe communication, process creation, and code injection into other processes.
BLOODALCHEMY supports several persistence mechanisms, including scheduled tasks, services, registry Run entries, and COM-based task scheduling. It can copy itself into a persistence location selected according to privilege level and can masquerade as a stopped service while continuing to run. The malware includes anti-debugging and anti-sandbox checks, encrypted strings and configuration data, and logic for loading configuration values such as command-and-control endpoints, mutexes, process names for injection, and behavioral flags.
Its communications support HTTP, sockets, and named pipes, with optional encryption, compression, and Base64 encoding. Reported backdoor functionality includes updating components, uninstalling itself, storing or deleting payload data in the registry, gathering host information, launching components, and managing proxy settings. It also supports process injection and post-compromise execution workflows suitable for stealthy long-term access.
BLOODALCHEMY has been observed in government-focused espionage environments in Southern and Southeastern Asia, and later reporting indicates variants were also used in campaigns targeting the energy sector in Central Asia. Multiple reports note that it appears to be favored by several China-aligned threat actors, reinforcing its role as a shared or reused espionage backdoor within that ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
References: https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor
...phishing emails to deliver a variant of BLOODALCHEMY and custom backdoors such as kidsRAT and RustVoralix.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
persistence_flag の値(1~4)に応じて永続化に向けた設定を作成します。 1: service + startup + taskschd (COM obj) ... 4: taskschd (COM obj)
当該ファイルを配置後に、スケジュールタスク(C:\Windows\System32\Tasks\Dell\BrDifxapi)を作成し、永続化を実施していることがわかります。
When using a named pipe, the name is randomly generated using the current PID as seed. | Persistence is achieved via different methods depending on the configuration: ... Using COM interfaces ... Using the TaskScheduler::ITaskService COM interface.
During the initial execution phase, the adversary deployed a benign utility, BrDifxapi.exe, which is vulnerable to DLL side-loading. When deploying this vulnerable utility the adversary could side-load the unsigned BLOODALCHEMY loader (BrLogAPI.dll) and inject shellcode into the current process.
persistence_flag の値(1~4)に応じて永続化に向けた設定を作成します。 1: service + startup + taskschd (COM obj) ... 4: taskschd (COM obj)
当該ファイルを配置後に、スケジュールタスク(C:\Windows\System32\Tasks\Dell\BrDifxapi)を作成し、永続化を実施していることがわかります。
攻撃者は BloodAlchemy の感染経路として、VPN 機器にある保守ベンダー専用アカウントを乗っ取った上で BloodAlchemy に感染させるためのファイルセットを使用していました。
0x1302 load received payload and store it into registry value 0x1303 delete registry value
run_mode が0または4かつ、malware configuration の0x68の値が1の場合、0x6cから0x74に設定されている以下のプロセスを作成した上で、shellcode をそのプロセスへ注入しようとします。
persistence_flag の値(1~4)に応じて永続化に向けた設定を作成します。 1: service + startup + taskschd (COM obj) ... 4: taskschd (COM obj)
当該ファイルを配置後に、スケジュールタスク(C:\Windows\System32\Tasks\Dell\BrDifxapi)を作成し、永続化を実施していることがわかります。
ペイロードには Process Injection の機能が含まれています。 run_mode が0または3かつ、malware configuration の0x54の値が1の場合、configuration の0x58から0x64に設定されている以下プロセスに対して、前述した Shellcode を注入しようとします。
注入された Shellcode を非同期プロシージャコール(APC)のキューとして設定するために QueueUserAPC() 関数が使用されます。これは Early Bard Injection といわれる手法です。
攻撃者は BloodAlchemy の感染経路として、VPN 機器にある保守ベンダー専用アカウントを乗っ取った上で BloodAlchemy に感染させるためのファイルセットを使用していました。
run_mode が0または4かつ、malware configuration の0x68の値が1の場合、0x6cから0x74に設定されている以下のプロセスを作成した上で、shellcode をそのプロセスへ注入しようとします。
To hide its strings the BLOODALCHEMY malware uses a classic technique where each string is encrypted, preceded by a single-byte decryption key, and finally, all concatenated together to form what we call an encrypted blob.
Also when running as a service and started by the service manager the malware will masquerade itself as stopped by first setting the service status to “SERVICE_RUNNING” then setting the status to “SERVICE_STOPPED” while in fact the malware is still running.
ペイロードには Process Injection の機能が含まれています。 run_mode が0または3かつ、malware configuration の0x54の値が1の場合、configuration の0x58から0x64に設定されている以下プロセスに対して、前述した Shellcode を注入しようとします。
注入された Shellcode を非同期プロシージャコール(APC)のキューとして設定するために QueueUserAPC() 関数が使用されます。これは Early Bard Injection といわれる手法です。
攻撃者は BloodAlchemy の感染経路として、VPN 機器にある保守ベンダー専用アカウントを乗っ取った上で BloodAlchemy に感染させるためのファイルセットを使用していました。
この悪性 DLL は同じフォルダ内の DIFX を読み込み、読み込んだデータから Shellcode を復号し、メモリ内でこの Shellcode を実行します。Shellcode の復号に使われているアルゴリズムは AES128(CBC モード)
Payload にはサンドボックスへの耐解析機能(Anti Sandbox)も含まれています。... process_name やファイル、DNS の結果を確認します。
During the initial execution phase, the adversary deployed a benign utility, BrDifxapi.exe, which is vulnerable to DLL side-loading. When deploying this vulnerable utility the adversary could side-load the unsigned BLOODALCHEMY loader (BrLogAPI.dll) and inject shellcode into the current process.
BloodAlchemy のメイン機能は、C2 サーバーと通信を行い、実装されている backdoor コマンドによって RAT として動作します。
The malware communicates using either the HTTP protocol, named pipes, or sockets. When using the HTTP protocol the malware requests the following URI /Inform/logger/.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family delivered via phishing in a July 2025 campaign targeting the energy sector in Central Asia.
Backdoor malware used by multiple China-aligned APT groups for persistent access and espionage.
A remote access trojan/backdoor analyzed in an intrusion where attackers used a compromised vendor-only VPN account to deploy a file set, establish persistence via scheduled task, side-load a malicious DLL, decrypt shellcode, and load the payload in memory. It supports multiple run modes controlling C2 communications, backdoor functions, persistence, anti-debug/anti-sandbox behavior, process creation and injection, named pipe creation, and installation. It stores encrypted configuration including C2 URLs, mutexes, and target process names, and implements 15 backdoor commands such as config updates, payload/component updates, uninstall, proxy handling, and victim info gathering.
An x86 backdoor delivered as shellcode and loaded via DLL sideloading into a legitimate signed process. It supports multiple persistence methods, multiple communication channels including HTTP, named pipes, and sockets, process injection, service-based execution, host information gathering, and toolset overwrite/uninstall commands. The report notes it is likely part of a larger toolset and still in active development.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.