SLEEPWALKER Backdoor Uses a Crafted Packet to Run Custom Bytecode
Independent malware researcher Dominik Reichel has documented SLEEPWALKER, a previously unreported Windows backdoor that waits in memory for a specifically crafted network packet before executing commands expressed in a proprietary 23-instruction bytecode language. The analysed sample is an unsigned 64-bit DLL measuring 59,904 bytes and is designed to be side-loaded into ERAAgent.exe, the executable used by ESET Management Agent.
The DLL impersonates Microsoft’s dpapi.dll. It exports the same seven data-protection functions as the legitimate system library and includes a version resource copied from ESET Management Agent. SLEEPWALKER has no embedded domains, IP addresses or URLs and does not initiate outbound connections, limiting the value of detection methods focused on known-bad network infrastructure.
A passive implant rather than an entry route
Its embedded configuration decrypts with AES-256-CCM to a single instruction that monitors every network interface indefinitely for a trigger packet. The listener captures traffic crossing monitored interfaces, including traffic addressed to other devices. That makes gateways, VPN servers and hosts bridging network segments potentially capable of observing a trigger intended for another machine.
Reichel described the design as consistent with a targeted, well-resourced operation, while stressing that the available evidence is one binary with no collection context. He could not attribute it to a known actor, identify a victim, industry or country, or determine whether the sample was deployed.
SLEEPWALKER checks the host process name but not its signature or path. An operator would need local administrator rights to place the DLL in the relevant directory. The malware uses the security context of its host process rather than elevating privileges itself, making it a post-compromise implant. Its only persistence method is side-loading: the DLL loads whenever the ESET Management Agent service starts.
Bytecode, transports and detection signals
The instruction set supports scheduling, several data-transfer methods, staged file delivery checked with SHA-256 before execution, and direct in-memory code execution. It supports TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture and VMware Virtual Machine Communication Interface (VMCI). VMCI traffic moves through the virtualisation layer rather than a network adapter, so a capture between two machines would not see it.
The analysed configuration enables only the raw-packet listener, although the binary also contains an inactive DNS-based trigger. No instruction writes to disk, meaning any files expected by the implant must be placed on the system by another component.
To expose its named-pipe channel to unauthenticated callers, the backdoor sets EveryoneIncludesAnonymous and adds its pipe name to NullSessionPipes. Its cleanup routine can remove a legitimate pre-existing NullSessionPipes entry because it records whether its own write succeeded rather than whether the entry already existed.
What defenders should examine
Reichel’s indicators include an unexpected dpapi.dll beside ERAAgent.exe, an unexpected dpapisvc.dll in the same directory, EveryoneIncludesAnonymous set to 1 and an unusual NullSessionPipes entry. The DLL’s SHA-256 is d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60. Registry findings need comparison with a known-good baseline.
The researcher provided a YARA rule and a read-only PowerShell scanner for estate-wide checks, while noting that rule components tied to a static AES key and compiled protocol code may fail against a rebuilt variant. Because the side-loading technique uses Windows DLL search order rather than an ESET software flaw, there is no patch for this behaviour. Organisations that confirm a match should investigate the broader compromise and rebuild the affected host.