# BloodAlchemy RAT - Evolved Deed RAT Variant with ShadowPad Code Lineage

> ITOCHU Cyber & Intelligence analysis identifies BloodAlchemy (BLOODALCHEMY) as an evolution of Deed RAT rather than new malware, with code similarities suggesting shared lineage with ShadowPad. It uses a multi-stage infection chain with legitimate-binary DLL side-loading, encrypted shellcode and Early Bird injection, and supports 15 backdoor commands.

- **Published:** 2026-10-30T18:18:01Z
- **Last reviewed:** 2026-10-30T18:18:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4846
- **ID:** TL-2026-4846
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BLOODALCHEMY is an x86 backdoor written in C, first documented by Elastic Security Labs on 2023-10-13 in connection with the REF5961 intrusion set targeting ASEAN government entities. ITOCHU Cyber & Intelligence (2024-05-23) concluded that it is an evolved Deed RAT variant. Deed RAT was previously associated exclusively with the Space Pirates group, and is viewed as a successor to ShadowPad. The shared traits include the unique payload header data structure (magic 45 AB 45 AB, plugin ID 0x10) and a similar virtual function table per protocol ID. Lineage described in the source: ShadowPad -> Deed RAT -> BloodAlchemy.

Infection chain: the reported initial access vector is takeover of a vendor maintenance account on a VPN device. Three files are then placed in C:\windows\: the legitimate, signed Brother Industries binary BrDifxapi.exe (vulnerable to DLL side-loading), the malicious loader BrLogAPI.dll, and DIFX, an encrypted shellcode container. BrLogAPI.dll decrypts the shellcode from DIFX using AES-128-CBC, with the key being the first 16 bytes of the DIFX file. The shellcode then decrypts the final payload using a custom routine based on the FNV-1a hash combined with LZNT1 decompression. Configuration is protected by a custom single-byte XOR variant with bit rotation. Persistence for the loader set uses a scheduled task at C:\Windows\System32\Tasks\Dell\BrDifxapi.

Run modes 0-6 control behavior: 0 is full operation (C2, backdoor, process injection, anti-debug, anti-sandbox, persistence); 1 is C2 and backdoor only; 2 is threading for C2; 3 is C2, backdoor, injection, anti-analysis and persistence; 4 is process creation for injection; 5 is named pipe creation; 6 is malware installation. Persistence selected by persistence_flag (1-4) uses a service, startup, and COM-based Task Scheduler in combinations, installing test.exe into %AUTOPATH%\Test\, %LocalAppData%\Programs\Test\, %ProgramFiles%\Test\ or %ProgramFiles(x86)%\Test\. Encrypted configuration is stored in C:\ProgramData\Store\ under a 15-character [a-zA-Z] file name. Injection uses the Early Bird technique (QueueUserAPC) into SearchIndexer.exe, wininit.exe, taskhost.exe, svchost.exe or taskeng.exe. Anti-sandbox checks process names (Trellix-focused), file artifacts and DNS results; anti-debugging is enabled in run modes 0 and 3.

The backdoor supports 15 commands (0x1101 update config, 0x1102 retrieve config, 0x1201/0x1202/0x1203 update test.exe/BrLogAPI.dll/DIFX, 0x1204 uninstall and terminate, 0x1205 launch test.exe, 0x1302 load payload and store in registry, 0x1303 delete registry value, 0x1401/0x1402 retrieve/update proxy info, 0x1501 gather victim information, 0x1502 echo, plus 0x1301 and 0x1304 of unknown function). Up to 10 C2 destinations are supported (one observed). Elastic reports communication over HTTP (URI /Inform/logger/), named pipes or sockets across DNS, HTTPS, TCP, UDP and SOCKS with optional encryption. Reported victims are government organizations in Southern and Southeast Asia (ASEAN); Trend Micro's Earth Estries research (Botconf 2024, Into the Vapor) also tied a new Deed RAT variant to government and technology targets in the Philippines, Taiwan, South Africa, Germany and the United States. Attribution is not confirmed: PolySwarm cites Vapor Panda as a suspected, unconfirmed actor, and the hunt context names Space Pirates, APT41, RedHotel and TAG-22 as related ShadowPad-family users. No domains, IPs or C2 infrastructure were published in the sources.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1574.001 DLL
- T1574.001 DLL
- T1055.004 Asynchronous Procedure Call
- T1055.004 Asynchronous Procedure Call
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1112 Modify Registry
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1090 Proxy
- T1573 Encrypted Channel

## Sources

- [Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy](https://blog-en.itochuci.co.jp/entry/2024/05/23/090000)
- [Disclosing the BLOODALCHEMY backdoor (Elastic Security Labs)](https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor)
- [Japanese Experts Warn of BLOODALCHEMY Malware (The Hacker News)](https://thehackernews.com/2024/05/japanese-experts-warn-of-bloodalchemy.html)
- [BloodAlchemy targeted government entities in Asia (PolySwarm)](https://blog.polyswarm.io/bloodalchemy-targeted-government-entities-in-asia)
- [Into the Vapor: Tracking Down Unknown Panda's Claw Marks (Botconf 2024)](https://www.botconf.eu/botconf-presentation-or-article/into-the-vapor-to-tracking-down-unknown-pandas-claw-marks/)
- [Botconf 2024 slides - Into the Vapor (ITOCHU Cyber & Intelligence)](https://www.botconf.eu/wp-content/uploads/formidable/2/BOTCONF2024-NiwaIshimaruSato-IntotheVapor_ICI.pdf)
- [Space Pirates: a look into the group's unconventional techniques, new attack vectors and tools (PT ESC)](https://ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-a-look-into-the-group-s-unconventional-techniques-new-attack-vectors-and-tools)
- [Novel BLOODALCHEMY malware examined (SC Media)](https://scmagazine.com/brief/novel-bloodalchemy-malware-examined)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4846