SLEEPWALKER: A Passive Backdoor With Its Own Command Language

Author's Note: The loss of VirusTotal Intelligence access at the start of the year proved to be an unexpected catalyst for productivity. Without the ability to hunt for fresh malware, I stopped expanding my "TODO" list and finally tackled my existing backlog. This process led me to a deep dive into BeheMOF and the eventual discovery of the threat detailed here.

At first glance, the sample seemed unremarkable. However, a deeper technical analysis revealed a sophisticated architectural design: a passive backdoor that avoids opening any obvious listening ports and contains no internal payload. It remains dormant in memory until it receives a specifically engineered network packet—hence the name SLEEPWALKER.

The most intriguing aspect is the nature of that trigger packet. It doesn't contain plain-text commands; instead, it delivers a compact program written in a proprietary command language developed specifically for this backdoor.

The Internal Architecture

The backdoor's custom language consists of 23 distinct instructions. These instructions facilitate:

• Task scheduling.
• Various data movement methodologies.
• Staged delivery of files.
• Direct execution of code within memory.

Simply extracting the encryption key is insufficient for analysis; one must fully reverse-engineer the internal bytecode to understand the attacker's intent. While the design is conceptually "cool" from a reverse-engineering standpoint, the actual implementation suffers from several engineering flaws.

---

Executive Summary

SLEEPWALKER is a passive implant that remains inactive until it is "awakened" by a specific encrypted packet. Upon activation, it decrypts and executes a task program provided by the attacker in the form of bytecode.

Deployment and Stealth

The malware is distributed as a 64-bit Windows DLL that masquerades as dpapi.dll. It utilizes a forged version resource to impersonate the ESET Management Agent. It is specifically designed for DLL side-loading into ERAAgent.exe (the ESET Management Agent executable), which ESET defines as a critical component for connecting endpoints to management platforms and enforcing local policies.

Activation Logic: The malware does not verify the file path or digital signature of the host; it only checks if the process name is ERAAgent.exe. If the name does not match, it remains dormant.

The Lifecycle of SLEEPWALKER

The following diagram illustrates the progression from initial side-loading to the execution of remote commands:

---

Technical Capabilities

1. The Bootstrap Process

The embedded configuration is encrypted using $\text{AES-256-CCM}$ (including a verified authentication tag). Once decrypted, it reveals a single bootstrap instruction: indefinitely monitor all network interfaces for the trigger packet.

2. The Bytecode Interpreter

The implant features a lean interpreter capable of processing 23 instructions. Key capabilities include:

• Payload Delivery: Staged file transfers verified via $\text{SHA-256}$.
• Execution: Running shellcode directly in memory.
• Network Transports:
  • TCP, UDP, and ICMP.
  • SMB named pipes (supporting lateral movement via provided credentials).
  • VMware's internal VMCI channel (facilitating communication between guest and host).
  • Raw-socket promiscuous sniffing.
  • DNS queries (serving as a secondary trigger channel).

3. System Manipulation

To ensure unauthenticated access to its named pipes, SLEEPWALKER actively degrades the security posture of the host machine by:

1. Enabling anonymous SMB access.
2. Creating named pipes with permissions granted to Everyone and Anonymous Logon.

4. Cryptography

Rather than relying on runtime-loaded libraries, the malware uses a statically linked version of mbedTLS, an open-source crypto library.

---

Analysis & Attribution

Because the backdoor uses standard listening ports and instead relies on passive triggers and covert channels (like VMCI and DNS), it is exceptionally difficult to detect via network monitoring. There is no "heartbeat" or open port to block until the operator sends the trigger.

Given the use of side-loading into a trusted ESET component and the complexity of the covert transports, this is likely a targeted attack. However, because the code does not match any known patterns in my database, I cannot attribute it to a specific threat actor.

Key Takeaways

• Unsigned DLL using ESET file metadata.
• Side-loaded into ERAAgent.exe.
• Passive trigger mechanism (no open ports).
• Custom 23-instruction bytecode language.
• Modifies Windows settings to allow anonymous SMB access.
• Uses mbedTLS for all encryption.

---

File Characteristics

The sample is an unsigned 64-bit DLL intended for the Windows GUI subsystem.

General Metadata:

• Size: 59,904 bytes
• Compilation Date: 2024-06-10 09:18:27 UTC

Hashes:

Forged Resource Information: The file mimics the real ESET Management Agent to avoid suspicion:

The DLL exports the same seven functions as the legitimate dpapi.dll to maintain compatibility during side-loading.

---

Appendix: Detection & Tools

YARA Rule

The following rule can be used to identify the SLEEPWALKER binary based on its unique strings and resource patterns.

rule SLEEPWALKER_Passive_Backdoor {
    meta:
        description = "Detects SLEEPWALKER passive backdoor DLL"
        author = "Malware Analyst"
        date = "2026-08-24"
    strings:
        $s1 = "ERAAgent.exe"
        $s2 = "ESET Management Agent"
        $s3 = "mbedTLS"
    condition:
        uint16(0) == 0x5A4D and all of them
}

Scanner Script

A read-only scanner script is provided to check for the presence of the malicious dpapi.dll in ESET installation directories.

# Mock-up of the read-only scanner
import os
import hashlib

def check_file(path):
    with open(path, "rb") as f:
        file_hash = hashlib.sha256(f.read()).hexdigest()
        return file_hash == "d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60"

# Scan target directory
target = "C:\\Program Files\\ESET\\ERAAgent\\"
if os.path.exists(os.path.join(target, "dpapi.dll")):
    if check_file(os.path.join(target, "dpapi.dll")):
        print("[!] SLEEPWALKER detected!")