In a remarkable discovery, malware researcher Dominik Reichel has unveiled a sophisticated backdoor for Windows, named Sleepwalker, which lies dormant in memory until activated by a specifically crafted network packet. This unique malware employs a 23-instruction command language, enabling it to execute a range of tasks, from running code directly in memory to exfiltrating data from the infected machine.
Unraveling Sleepwalker
Reichel’s technical analysis highlights the intricacies of Sleepwalker, emphasizing that the activation packet does not contain readable commands but rather a short program written in the backdoor’s proprietary language. “Recovering the encryption key is not enough to understand one of these programs,” Reichel noted. “The internal command language must be reverse engineered as well.”
What sets Sleepwalker apart is its ability to target a VMware VMCI instead of a conventional network address, suggesting a level of sophistication typically associated with well-resourced, targeted operations rather than opportunistic attacks. The malware masquerades as a legitimate Windows DLL file, specifically impersonating Microsoft’s dpapi.dll, which is integral to Windows’ data protection API. It mimics the original file’s seven functions while redirecting calls to a non-existent file named dpapisvc.dll.
Upon confirming its host process as ERAAgent.exe, the Windows executable for ESET Management Agent, Sleepwalker enters a dormant state in the computer’s memory, effectively evading detection by traditional antivirus solutions. Unlike many backdoors that establish a connection to a command-and-control (C2) server, Sleepwalker remains passive, monitoring network traffic for a specific pattern known as a magic packet. Once it identifies the correct packet, it decrypts the data and interprets it as a command.
Decoding Commands
Each command sent to Sleepwalker is encrypted using AES-256-CCM, and once decrypted, it manifests as a sequence of raw bytes that must be read in a specific order. Reichel’s analysis provides a key for interpreting these bytes, detailing Sleepwalker’s 23 instructions. Among these, certain commands can embed inner programs, such as a scheduler that includes a network listener, waiting for specific files to be assembled before execution.
The backdoor boasts a variety of functionalities, including:
- Four instructions for sending and concealing data, such as establishing a TCP connection to a designated address and port.
- Five instructions focused on receiving tasks, which may involve opening a TCP or UDP port or connecting to a named pipe.
- Additional commands for constructing and executing programs.
Challenges in Detection
Despite the detailed examination, Reichel acknowledges significant gaps in knowledge surrounding Sleepwalker. “I have no collection context tying the file to a confirmed intrusion, so I cannot identify a victim, industry, country, or affected organization,” he stated. The method of initial access to the compromised systems remains unclear, as does the identity of the operator or developer behind the malware.
Reichel has taken proactive steps to assist those who may be affected by Sleepwalker. He has developed a toolkit designed to decode its bytecode, analyze encrypted artifacts, and summarize its behavior without executing any commands or transmitting traffic. Additionally, a mitigation guide, complete with a remediation script, has been created for use following the detection of Sleepwalker.
