Windows Backdoor 'Sleepwalker' Hides in Memory, Awaits Magic Packet
A newly identified Windows backdoor called Sleepwalker stays dormant in memory, evading detection until triggered by a specially crafted network packet, according to The Register.
Unlike most backdoors, which call back to an attacker-controlled server, Sleepwalker generates no outgoing traffic and opens no obvious listening port, Reichel said in a technical analysis released Monday. Instead, it inspects every network packet that passes through the host, looking for a specific pattern. Once the matching "magic packet" arrives, the backdoor decrypts its payload and treats it as a series of commands.
The commands cover scheduling, multiple data movement methods, staged file delivery, and direct in-memory code execution, Reichel explained. "What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor's own design," he said. "Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well."
Sleepwalker is embedded in a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll, part of the Windows Data Protection API. It exports the same seven functions as the genuine dpapi.dll, but attempts to forward calls to a non-existent file named dpapisvc.dll. The malware also carries a forged ESET Management Agent version resource and loads through side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent.
After verifying that its host process is ERAAgent.exe, the backdoor enters a dormant state in memory, which further hides it from antivirus tools. The remote host can also be a VMware VMCI target instead of a normal network address, a feature that Reichel said is consistent with "a targeted, well-resourced operation rather than an opportunistic one."
Reichel warned that the lack of outbound connections or obvious listening ports means network monitoring tools will see nothing unusual. "A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag," he wrote. "The absence of outbound connections to known-bad infrastructure does not rule out an infection, either."