An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design.
The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent.
It impersonates Microsoft’s dpapi.dll, exporting the same seven data protection functions as the genuine system library, and carries a version resource copied from ESET Management Agent.
There are no domains, IP addresses or URLs built into the file, and it makes no outbound connection of its own, so an infected host can look clean to tooling that watches for connections to known-bad infrastructure.
Commands arrive as bytecode rather than readable text, so recovering the encryption key yields opcodes in a format that exists nowhere but inside this one file. Dominik Reichel, a former Palo Alto Networks Unit 42 malware researcher, said the approach is “consistent with a targeted, well-resourced operation rather than an opportunistic one.”
The assessment rests on a single binary supplied with no collection context, and Reichel could not attribute the sample to any known actor, establish a victim, an industry, or a country, or determine whether the sample was ever deployed.
Its embedded configuration decrypts using AES-256-CCM into a single instruction that tells the backdoor to monitor every network interface indefinitely for that packet.
The listener captures everything crossing each watched interface, including traffic addressed to other machines. A gateway, VPN server or host bridging two network segments could therefore see a trigger meant for a different machine entirely.
SLEEPWALKER checks only the host process name, not its signature or path. Writing the file into that directory requires local administrator rights that an operator must already hold, and the backdoor relies on the security context of its host process rather than obtaining those rights itself.
The backdoor is therefore a post-compromise implant rather than an entry point, and how an operator first reached the machine and wrote the DLL into that directory remains unknown.
Side-loading is also its only persistence mechanism, and the DLL loads again each time the ESET Management Agent service starts.
The side-loading relies on Windows DLL search order rather than a flaw in ESET’s software, so there is nothing to patch, and the response to a confirmed match is incident response and a rebuild.
ESET’s products have been abused for side-loading before, including by ToddyCat, which Kaspersky said exploited a search-order flaw in the company’s command-line scanner to load a malicious DLL into ESET.
The Hacker News has reached out to ESET for comment on whether it has telemetry on the sample and will update this story with any response.
ESET has issued no advisory or public statement on the malware as of August 26.
The 23 instructions cover scheduling, several ways to move data, staged file delivery verified against a SHA-256 hash before it runs, and executing code directly in memory. They ride on six transports, comprising TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware’s Virtual Machine Communication Interface (VMCI).
VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it entirely. UNC3886 used VMCI sockets for persistence between compromised ESXi hosts and their guest virtual machines in intrusions documented by Mandiant.
No instruction in the language writes to disk, so anything the backdoor expects to find on a compromised machine has to be placed there by another component.
Two of the instructions watch for the trigger. The opcode stored in the analyzed sample enables only the raw-packet listener. At the same time, a second opcode also enables a DNS-based trigger implemented in the binary but not active in this build.
To let unauthenticated callers reach its named-pipe channel, SLEEPWALKER sets the EveryoneIncludesAnonymous registry value and adds its pipe name to NullSessionPipes. Its cleanup routine records whether its own write to NullSessionPipes succeeded rather than whether an entry was already present, so a removal can delete a legitimate entry that predates the infection.
Reichel published the following host indicators –
- An unexpected dpapi.dll beside ERAAgent.exe
- An unexpected dpapisvc.dll in the same directory
- SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
- MD5: 2318327b29bb1c0e2d2b5f0211fc7fac
- EveryoneIncludesAnonymous set to 1
- An unexpected entry in NullSessionPipes
The two registry values carry weight only against a known-good baseline.
The writeup ships a YARA rule and a read-only PowerShell scanner that checks those indicators across an estate. Reichel said detection coverage for the file was low at publication, without stating a basis for that assessment.
He noted that the YARA rule keys partly on a static AES key and on compiled protocol code, which a rebuild with different compiler settings could break.
The Hacker News found no public release of the analysis toolkit or the mitigation guide described in the post on Reichel’s site or his GitHub profile as of August 26. Reichel said anyone who believes they have been targeted should contact him directly.
Magic-packet implants of this kind have surfaced on Linux systems, including Red Menshen’s use of passive backdoors like BPFDoor inside telecom operator networks, as documented by Rapid7.
