SLEEPWALKER: the backdoor that sleeps until one “magic packet” arrives

Independent malware researcher Dominik Reichel, formerly of Palo Alto Networks' Unit 42, has published an analysis of a previously undocumented Windows backdoor called SLEEPWALKER. The sample is an unsigned 64-bit DLL of 59,904 bytes. It masquerades as Microsoft's system library dpapi.dll, exporting the same seven data-protection functions, and is designed to be side-loaded into ERAAgent.exe — the ESET Management Agent executable.

Silent until someone knocks

SLEEPWALKER's defining trait is that it does nothing on its own. The file contains no domains, IP addresses or URLs, and it establishes no outbound connections — an infected machine looks clean to tools that watch for contact with known malicious infrastructure. Instead, the backdoor listens indefinitely on all network interfaces, waiting for a single specially crafted packet. The listener captures all passing traffic, including traffic addressed to other machines, so a gateway, VPN server or node sitting at the boundary between segments could accidentally catch a trigger meant for a neighbor.

Once it receives the signal, SLEEPWALKER executes commands that arrive as bytecode in a custom 23-instruction language. Even after recovering the encryption key (AES-256-CCM), an analyst is left with opcodes in a format that exists only inside this file. Reichel considers this approach a hallmark of “a targeted, well-resourced operation rather than an opportunistic one.”

What the 23-command language can do

The instructions cover task scheduling, several methods of data transfer, staged file delivery with a SHA-256 check before launch, and code execution directly in memory. Not a single command writes to disk. There are six transports: TCP, UDP, ICMP, named SMB pipes with lateral movement across the network, “raw” packet capture and VMware VMCI. VMCI traffic travels through the virtualization layer, bypassing the network adapter — capture between two machines simply won't see it.

To open unauthenticated access to its named pipe, the backdoor sets the registry value EveryoneIncludesAnonymous and adds the pipe name to NullSessionPipes. Its cleanup routine, however, may delete a legitimate entry that existed before the infection.

Not a front door, but the aftermath of a breach

SLEEPWALKER is a post-exploitation implant, not an entry point: to write the DLL into the right directory, the operator must already hold local administrator rights. The side-loading relies on Windows' DLL search order, not on a vulnerability in ESET products, so there is nothing to “patch” here — the response to a confirmed match is incident response and rebuilding the system. As of August 26, ESET had issued no statements.

Reichel was unable to tie the sample to a known group, identify the victim or country, or even determine whether it had been used in real attacks. He published indicators of compromise, a YARA rule and a PowerShell scanner, noting that detection coverage at the time of publication was low.

Source: The Hacker News