“What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor’s own design,” malware researcher Dominik Reichel wrote after discovering a previously unseen Windows backdoor he calls Sleepwalker.
How Sleepwalker hides inside Windows processes
Sleepwalker was found inside a 64‑bit Windows DLL that impersonates Microsoft’s dpapi.dll, the system component used by Windows' Data Protection API. The malicious DLL exports the same seven functions as the legitimate dpapi.dll but attempts to forward those calls to a non‑existent file named dpapisvc.dll. The sample also contains a forged ESET Management Agent version resource and is designed to load via side‑loading into ERAAgent.exe, the executable for ESET Management Agent. After confirming its host process name is ERAAgent.exe, the backdoor “goes to sleep” inside memory — a persistence and hiding tactic that helps it evade traditional antivirus and endpoint monitoring tools.
A command language built for covert control
Unlike most remote access tools that immediately call out to a command‑and‑control server, Sleepwalker passively inspects every packet that traverses the host’s network stack looking for a precise “magic packet.” When such a packet is observed, the backdoor decrypts its payload and treats the result as a program. All commands are encrypted with AES‑256‑CCM and, once decrypted, are not human‑readable text or documents: they are short sequences of raw bytes that only make sense when interpreted according to Sleepwalker’s bespoke 23‑instruction language. Reichel notes that recovering the encryption key alone “is not enough to understand one of these programs. The internal command language must be reverse engineered as well.”
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCapabilities: networking, named pipes, in‑memory execution, and VMware VMCI
Reichel’s analysis catalogs Sleepwalker’s instruction set and shows a broad, capable toolkit. The backdoor includes two magic‑packet sniffing instructions and basic control commands — for example, an exit command that stops all running programs and the packet listener, and an instruction that launches a second, smaller program to run concurrently.
More advanced instructions support data movement and covert channels. Four instructions relate to sending and hiding data: one opens a TCP connection to a chosen address and port and sends a block of data (the remote target may be a VMware VMCI target rather than a conventional network address), another writes a block of data to a Windows named pipe on a remote machine and can optionally authenticate with a username and password first. Five instructions focus on receiving follow‑up tasks, including waiting for a subsequent instruction, opening a TCP or UDP port, or creating/connecting to a named pipe. There are also five instructions dedicated to building and running programs, and at least one scheduler instruction that can contain an inner program — for example, a network listener that assembles and checks a staged file before execution.
Why Sleepwalker challenges detection and response
Reichel emphasizes the operational stealth of the sample. Because the backdoor does not initiate outbound connections by default and does not open an obvious listening port, security tools that rely on detecting connections to known‑bad domains or unusual outbound traffic can miss an infection entirely. “The absence of outbound connections to known‑bad infrastructure does not rule out an infection, either,” he wrote. A compromised machine can “produce nothing at all for a network monitor to flag.”
To help defenders, Reichel published a toolkit that decodes Sleepwalker’s bytecode, examines encrypted and network artifacts, summarizes behavior and indicators, and reproduces its receiving pipeline in a safe way that does not execute commands or transmit traffic. He also created a mitigation guide and a remediation script intended for use after detection, and urged potentially targeted individuals to contact him for assistance.
What this means for technologists, procurement teams, and end users
- Technologists and security teams: Expect investigations to require bytecode analysis in addition to cryptographic key recovery. Network monitoring alone may not surface this backdoor because it can remain fully passive until awakened by a magic packet.
- Procurement and operations leaders responsible for endpoint agents: The sample’s use of side‑loading into ERAAgent.exe and a forged ESET Management Agent resource highlights the need to validate the integrity and provenance of locally installed agent binaries and adjacent DLLs.
- End users and administrators: Because Sleepwalker sleeps in memory after confirming a host process name, discovery may require memory analysis and artifact examination rather than relying solely on file‑based AV signatures or outbound traffic anomalies.
Reichel’s write‑up makes clear both the sophistication of this single sample and the limits of what can be concluded from it: he found no collection context tying the file to a confirmed intrusion, no related code linking it to a known group, and no evidence about victims, sectors, or geographic scope. What exists now are a highly capable sample, a published toolkit and remediation script, and outstanding questions about how the DLL was first delivered, who developed or operated it, and whether variants or broader campaigns exist. For defenders confronting similar, low‑noisy threats, Reichel’s artifacts and guidance provide a concrete starting point.
