A previously unreported Windows backdoor called SLEEPWALKER has been documented by an independent malware researcher. The SLEEPWALKER backdoor remains dormant in memory until a specifically crafted network packet triggers it, at which point it executes commands written in a custom 23-instruction bytecode language. This approach makes the malware difficult to detect using conventional network monitoring tools, as it contains no hardcoded domains, IP addresses, or URLs, and makes no outbound connections on its own.
Technical Design and Evasion Methods
The SLEEPWALKER backdoor is a 59,904-byte unsigned 64-bit Windows dynamic-link library (DLL) designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. It impersonates Microsoft’s dpapi.dll by exporting the same seven data protection functions as the genuine system library, complete with a version resource copied from ESET Management Agent. This disguise helps it blend in with legitimate system files.
Commands arrive as bytecode rather than readable text, making the SLEEPWALKER backdoor particularly evasive. The encryption key decrypts into opcodes in a format that exists nowhere but inside this single file. According to Dominik Reichel, a former Palo Alto Networks Unit 42 malware researcher, this approach is “consistent with a targeted, well-resourced operation rather than an opportunistic one.” The embedded configuration uses AES-256-CCM encryption and decrypts into a single instruction that tells the backdoor to monitor every network interface indefinitely for the trigger packet.
Capabilities and Post-Compromise Nature
The 23 instructions in the SLEEPWALKER backdoor’s custom language cover scheduling, data movement, staged file delivery verified against SHA-256 hashes, and direct code execution in memory. These commands operate across six transports: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware’s Virtual Machine Communication Interface (VMCI). Notably, no instruction writes to disk, meaning any files the backdoor needs must be placed there by another component.
The backdoor functions as a post-compromise implant rather than an entry point, requiring local administrator rights to deploy. Side-loading serves as its only persistence mechanism, reloading each time the ESET Management Agent service starts. Since side-loading exploits Windows DLL search order rather than a software vulnerability, there is no patch available—the response to a confirmed infection is incident response and system rebuild. Detection coverage for the file was reportedly low at the time of analysis, though the researcher provided a YARA rule and PowerShell scanner for hunting across networks.
المصدر: The Hacker News
