An independent malware researcher has documented a previously unreported Windows backdoor named SLEEPWALKER that remains inactive in system memory until it receives a specially crafted network packet, after which it executes commands through its own custom bytecode language. According to the technical analysis, the malware is designed as an unsigned 64 bit Windows dynamic link library measuring 59,904 bytes and is intended to be side loaded into ERAAgent.exe, the Windows executable used by ESET Management Agent. The malicious library impersonates Microsoft’s legitimate dpapi.dll by exporting the same seven data protection functions and includes version information copied from the ESET Management Agent, making it appear legitimate during casual inspection. The sample contains no embedded domains, IP addresses, or URLs and establishes no outbound network connections on its own, allowing an infected system to appear clean to security tools that primarily monitor communication with known malicious infrastructure.
The researcher, Dominik Reichel, a former Palo Alto Networks Unit 42 malware researcher, stated that commands are delivered in encrypted bytecode rather than readable text, with the malware using a unique 23 instruction language that exists only within the analyzed sample. According to Reichel, this level of design is consistent with a targeted and well resourced operation rather than a broad opportunistic campaign. However, the assessment is based on a single binary that was supplied without collection context, preventing attribution to a known threat actor or identification of the intended victim, targeted industry, country, or confirmation that the malware was ever deployed in an active intrusion. The embedded configuration is decrypted using AES 256 CCM encryption into a single instruction directing the malware to continuously monitor every available network interface for a specially crafted trigger packet. Once active, the listener captures all traffic crossing monitored interfaces, including packets addressed to other systems, meaning gateway devices, virtual private network servers, or systems bridging multiple network segments could potentially detect trigger packets intended for different machines. Researchers determined that the malware functions as a post compromise implant because it requires local administrator privileges to place the malicious library beside ERAAgent.exe and relies entirely on the security context of the host process rather than attempting to elevate privileges independently.
The report explains that DLL side loading serves as the malware only persistence mechanism, with the malicious library automatically loading whenever the ESET Management Agent service starts. This technique relies on the Windows DLL search order instead of exploiting a software vulnerability within ESET products, meaning there is no software patch available to prevent this behavior. The recommended response to a confirmed compromise is incident response followed by rebuilding the affected system. The malware supports twenty three instructions that cover scheduling tasks, multiple methods of data transfer, staged file delivery verified through SHA 256 hashes before execution, and direct in memory code execution. Communication is supported through TCP, UDP, ICMP, SMB named pipes with credential based lateral movement, raw packet capture, and VMware Virtual Machine Communication Interface. The analysis also identified a dormant DNS based trigger capability that exists within the binary but remains disabled in the analyzed sample. To allow unauthenticated access to its named pipe communication channel, SLEEPWALKER modifies the EveryoneIncludesAnonymous registry value and adds its pipe name to NullSessionPipes. Researchers observed that the malware cleanup routine may unintentionally remove legitimate registry entries because it records only whether it successfully modified the registry rather than whether an entry already existed before infection.
Reichel published several indicators that defenders can use during investigations, including unexpected dpapi.dll and dpapisvc.dll files located beside ERAAgent.exe, specific SHA 256 and MD5 file hashes, the EveryoneIncludesAnonymous registry value being set to one, and unexpected entries within NullSessionPipes. He noted that registry indicators should always be evaluated against known good baselines because legitimate environments may contain different configurations. The research also includes a YARA detection rule and a read only PowerShell scanner capable of checking these indicators across enterprise environments, although detection coverage was described as limited at the time of publication. Reichel added that the YARA signatures partially depend on static encryption keys and compiled protocol code, meaning future rebuilt versions could evade detection. As of August 26, ESET had not issued a public advisory or statement regarding the malware, while The Hacker News reported contacting the company for comment. The researcher also noted that similar passive backdoor techniques have previously appeared in Linux environments, including the use of stealth implants such as BPFDoor within telecommunications networks, demonstrating that passive activation methods continue to remain an area of interest in advanced malware development.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
