A newly identified Windows backdoor, dubbed "Sleepwalker," operates by lying dormant in memory, awaiting a specially crafted "magic packet" to deliver commands through its unique 23-instruction language. This sophisticated malware, detailed by researcher Dominik Reichel, is designed to evade traditional security tools by not initiating outbound connections or opening obvious listening ports.
Sleepwalker is implemented as a 64-bit Windows DLL file that masquerades as Microsoft's legitimate `dpapi.dll`, a component of the Windows data protection API. It exports the same seven functions as the authentic DLL but attempts to forward calls to a non-existent file named `dpapisvc.dll`. The malicious DLL also contains a forged ESET Management Agent version resource and is designed for side-loading into `ERAAgent.exe`, the Windows executable for ESET Management Agent. Upon confirming its host process is `ERAAgent.exe`, Sleepwalker goes into a passive state within the computer's memory.
Unlike typical backdoors that establish connections to command-and-control (C2) servers, Sleepwalker continuously monitors network traffic for a specific pattern—the "magic packet." Once detected, the backdoor decrypts the packet's contents, interpreting them as commands. This method allows it to remain undetected by tools that monitor for unusual outbound traffic or connections to known malicious domains. The commands are encrypted using AES-256-CCM, and their unique structure consists of raw bytes that must be read in a specific order, requiring reverse engineering of the internal command language in addition to key recovery.
The malware's 23 instructions cover a range of capabilities, including scheduling tasks, various methods for data exfiltration, staged file delivery, and executing code directly in memory. Notably, the remote host for data exfiltration can be a VMware VMCI target, not just a standard network address. Instructions include opening TCP connections to chosen addresses and ports, sending data blocks, and writing data to Windows named pipes, with an optional login using a username and password. Other instructions focus on inbound task reception, such as waiting for follow-up instructions, opening TCP or UDP ports, or creating and connecting to named pipes. The malware also features five instructions for building and running programs.
The design of Sleepwalker, with its custom command language and passive operational model, suggests a targeted and well-resourced operation rather than an opportunistic attack. However, the researcher has not yet tied the sample to a confirmed intrusion, leaving many unknowns regarding its deployment, victims, or the identity of its operators. The initial compromise vector and post-compromise activities also remain unclear. No related code has been found to attribute Sleepwalker to a known threat group, nor is it known how widely it has been deployed or if variants exist.
To aid in detection and analysis, the researcher has developed a toolkit for decoding Sleepwalker's bytecode, examining encrypted and network artifacts, summarizing its behavior and indicators, and safely reproducing its receiving pipeline without executing commands or transmitting traffic. A mitigation guide and remediation script are also available for use after detection.
