Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
Independent malware researcher documents a new Windows backdoor called SLEEPWALKER that waits for a specific packet before executing commands written in its own bytecode.
Intelligence analysis by Qwen 2.5 (3B)
An independent researcher has discovered a new Windows backdoor called SLEEPWALKER. It waits for a specific network packet before running commands written in its own bytecode.
Imagine a sneaky program that waits for a special message before doing something bad. It looks like a normal program, but it can secretly do things without you knowing.
Analysis
{"heading_1":"Understanding SLEEPWALKER","paragraph_1":"SLEEPWALKER is a newly discovered Windows backdoor that waits for a specific network packet before executing commands written in its own bytecode. The backdoor is built as a 64-bit Windows dynamic-link library (DLL) and is designed to be side-loaded into the ESET Management Agent.","paragraph_2":"The backdoor impersonates Microsoft's dpapi.dll, exporting the same seven data protection functions as the genuine system library. It also carries a version resource copied from ESET Management Agent.","paragraph_3":"SLEEPWALKER does not make any outbound connections of its own and can look clean to tooling that watches for connections to known-bad infrastructure. Commands arrive as bytecode rather than readable text, and the encryption key must be recovered to understand the commands.","paragraph_4":"The backdoor is designed to be a post-compromise implant rather than an entry point. It relies on the security context of its host process rather than obtaining those rights itself. The side-loading mechanism is also its only persistence mechanism.","paragraph_5":"The backdoor uses six transports, including TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI). VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it entirely."}
Key points
- SLEEPWALKER is a new Windows backdoor that waits for a specific network packet before executing commands written in its own bytecode.
- The backdoor impersonates Microsoft's dpapi.dll and does not make any outbound connections of its own.
- It relies on the security context of its host process rather than obtaining those rights itself.
By improving detection tools and security measures, we can better identify and respond to threats like SLEEPWALKER.
If SLEEPWALKER is deployed, it could be used to steal information or cause other damage without being detected.
