New Sleepwalker Backdoor Targets Windows Systems with Unique Command Language

• •Sleepwalker is a passive backdoor that activates upon receiving a specific network packet.
• •It uses a unique command language with 23 instructions for executing tasks in memory.
• •The malware impersonates legitimate Windows components to evade detection.

A newly discovered Windows backdoor named Sleepwalker has been detailed by malware researcher Dominik Reichel. This passive backdoor remains dormant in memory until it receives a specifically crafted network packet, which activates its 23-instruction command language. Sleepwalker is embedded in a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll and is designed to be side-loaded into the ESET Management Agent's executable, ERAAgent.exe. The malware does not open any listening ports or contact a command-and-control server, making it difficult for traditional security tools to detect. It can execute a variety of tasks, including running code in memory and moving data off the infected machine. The backdoor uses AES-256-CCM for encryption, and its unique command language requires reverse engineering for full understanding. Currently, there are no reports of active exploitation, but its design suggests it could be part of a targeted operation.