SLEEPWALKER Backdoor: A Stealthy Windows Implant Triggered by a Single Network Packet

A newly documented Windows backdoor named SLEEPWALKER has been detailed by independent malware researcher Dominik Reichel. The implant remains dormant in memory until it receives a specifically crafted network packet, after which it executes commands written in a custom 23-instruction bytecode language. The sample is an unsigned 64-bit DLL (59,904 bytes) designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. It impersonates Microsoft’s dpapi.dll, exporting the same seven data protection functions and carrying a version resource copied from ESET Management Agent.

SLEEPWALKER contains no hardcoded domains, IPs, or URLs and makes no outbound connections, making it difficult to detect via network monitoring. Commands arrive as bytecode, and the embedded configuration decrypts using AES-256-CCM to instruct the backdoor to monitor all network interfaces indefinitely for the trigger packet. The listener captures all traffic crossing each interface, including traffic addressed to other machines, meaning a gateway or VPN server could intercept triggers meant for other hosts.

The backdoor relies on Windows DLL search order for side-loading, not a vulnerability in ESET’s software, so there is no patch. Persistence is achieved through side-loading each time the ESET Management Agent service starts. The implant checks only the host process name, not its signature or path, and requires local administrator rights to be placed, indicating it is a post-compromise tool. The 23 instructions cover scheduling, data movement, staged file delivery verified via SHA-256, and in-memory code execution. They operate over six transports: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware’s VMCI. VMCI traffic bypasses network adapters, evading standard packet captures.

Reichel published indicators of compromise, including an unexpected dpapi.dll beside ERAAgent.exe, an unexpected dpapisvc.dll, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60, MD5 2318327b29bb1c0e2d2b5f0211fc7fac, EveryoneIncludesAnonymous set to 1, and an unexpected entry in NullSessionPipes. A YARA rule and a read-only PowerShell scanner are provided. The backdoor’s cleanup routine may delete legitimate NullSessionPipes entries. ESET has not issued an advisory as of August 26. The technique mirrors prior side-loading abuses by ToddyCat and magic-packet implants like BPFDoor used by Red Menshen.