Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet'

A new Windows backdoor, called Sleepwalker, has been discovered by malware researcher Dominik Reichel. This backdoor remains dormant in memory until it receives a specific network packet, known as a "magic packet," which then activates it and allows it to carry out commands using a 23-instruction language. The commands can range from running code directly in memory to moving data off the infected computer.

Unlike other backdoors, Sleepwalker does not initiate outgoing traffic or open any listening ports, making it difficult for traditional anti-virus tools to detect. Instead, it waits silently for the magic packet to arrive, then decrypts the data and treats it as a command.

The backdoor's command language consists of 23 instructions covering scheduling, data movement, staged file delivery, and running code directly in memory. However, simply recovering the encryption key is not enough to understand one of these programs, as the internal command language must also be reverse engineered.

Sleepwalker disguises itself as Microsoft's dpapi.dll, imitating its seven functions and exporting them. It also imports and side-loads a forged ESET Management Agent version resource, loading via the Windows executable for ESET Management Agent (ERAAgent.exe). Once it confirms its host process is named ERAAgent.exe, Sleepwalker goes to sleep in the computer's memory, effectively remaining hidden.

The specific magic packet used to activate Sleepwalker is not a readable command, but a short program written in the backdoor's own command language. This approach suggests a targeted, well-resourced operation rather than an opportunistic one.