New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.
Researcher Dominik Reichel documented SLEEPWALKER, an unsigned 59,904-byte 64-bit Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe while impersonating dpapi.dll. The implant monitors every network interface indefinitely for a specifically crafted trigger packet, then executes commands written in a custom 23-instruction bytecode language over six transports, including TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI. It has no embedded infrastructure, makes no outbound connections of its own, and requires prior local administrator access to install; no victims, attribution, or in-the-wild deployment are confirmed. Reichel assesses the design as consistent with a targeted, well-resourced operation, while ESET calls the scenario's security relevance negligible since it provides no new access path.
- Side-loads into ERAAgent.exe via DLL search order, impersonating dpapi.dll with no ESET flaw to patch.
- Stays inert until a crafted packet, then executes custom 23-instruction bytecode over six transports including VMCI.
- No embedded C2 infrastructure or outbound connections, so the host looks clean to network monitoring.
- VMCI transport bypasses host network capture, and a DNS-based trigger exists but is inactive in this build.
- No confirmed victims or attribution; ESET says prior admin access is already required.
- ATT&CK
- T1574.002 DLL Side-LoadingT1040 Network SniffingT1620 Reflective Code LoadingT1112 Modify RegistryT1021.002 SMB/Admin Shares
- Vendors
- ESET
- Products
- ESET Management Agent
- Malware
- SLEEPWALKER
From the original article
5 min read at thehackernews.com
An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER , that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into ERAAgent.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.