Sleepwalker: Passive Backdoor with Its Own Command Language

The malware sample known as SLEEPWALKER is a passive backdoor with its own unique command language. Unlike traditional malware that actively seeks out command and control servers, SLEEPWALKER operates silently in memory, waiting for a specific network packet to arrive before executing any tasks. This packet does not contain a readable command; instead, it carries a short program written in a custom command language designed by the backdoor itself.

SLEEPWALKER is delivered as a 64-bit Windows DLL that masquerades as Microsoft's dpapi.dll, a legitimate system file responsible for encryption and decryption. It accomplishes this through a technique called DLL side-loading, where it loads its own malicious code alongside the genuine dpapi.dll. Upon loading, SLEEPWALKER injects its code into the process of ESET Management Agent (ERAAgent.exe), a trusted Windows executable used for managing ESET endpoint security solutions.

Once loaded, SLEEPWALKER remains dormant, only activating when it receives the specially crafted trigger packet. This packet, which arrives over the network, contains a bytecode program that SLEEPWALKER interprets using its own bytecode interpreter with 23 instructions. This interpreter covers scheduling, data movement, staged file delivery, and in-memory shellcode execution.

The encrypted bytecode can be delivered through multiple covert channels, including named pipes using the SMB protocol, VMware's VMCI channel, or raw-socket promiscuous sniffing.

To facilitate this, SLEEPWALKER actively weakens the host machine by enabling anonymous SMB access and creating named pipes with permissions granted to Everyone and Anonymous Logon. The encryption for these communications is handled by a statically linked copy of mbedTLS, an open-source cryptography library, rather than relying on any runtime libraries.

Because of this, SLEEPWALKER is challenging to detect on the network side, as it remains dormant until it receives its trigger packet, and the network traffic it generates appears normal and unremarkable.