Disclosing the BLOODALCHEMY backdoor

BLOODALCHEMY is an x86 backdoor discovered as injected shellcode in a signed benign process and likely loaded via a malicious BrLogAPI.dll sideload; the report analyzes its custom string obfuscation, configuration decoding, multiple persistence methods (service, registry, scheduled task, COM), execution modes (in-thread, new process injection, service), C2 channels (HTTP, named pipes, sockets, and others), limited command set, YARA detections, and provides IOCs and hashes while noting it appears modular and under active development as part of the REF5961 intrusion set.