You don't want this Sleepwalker backdoor on your Windows machine

Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer.

Malware researcher Dominik Reichel discovered the passive backdoor, which also has its own command language, and detailed Sleepwalker in a technical analysis on Monday.

“What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor’s own design,” Reichel said. “Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well.”

In addition to having its own command language, it's also notable that the remote host can be a VMware VMCI target instead of a normal network address.

“Taken as a whole, the approach here is consistent with a targeted, well-resourced operation rather than an opportunistic one,” Reichel wrote.

The malware, hidden inside a 64-bit Windows DLL file, impersonates Microsoft's dpapi.dll, part of Windows' data protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll, but attempts to forward calls to a file named dpapisvc.dll, which is not a real Windows component.

The file also has a forged ESET Management Agent version resource, and loads via side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent. After confirming that its host process is named ERAAgent.exe, Sleepwalker goes to sleep inside the computer's memory, which also helps it remain hidden from traditional anti-virus tools.

Unlike most backdoors, which call back to an attacker-controlled command-and-control (C2) server and start receiving commands, Sleepwalker lies in wait, checking every packet that passes through the network looking for a specific pattern - this is called a magic packet. Once it sniffs out a packet that matches the exact pattern, the backdoor decrypts the data and treats it as a command.

“Because the backdoor never sends anything out on its own and does not open any obvious listening port by default, tools that watch for connections to known-bad domains or unusual outbound traffic will not see anything unusual,” Reichel wrote. “The absence of outbound connections to known-bad infrastructure does not rule out an infection, either. A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag.”

Hidden commands

Every command sent to the backdoor is encrypted using AES-256-CCM, and the command language is unique in that, once decrypted, it is neither text nor a document.

Instead, each command is a short sequence of raw bytes, and it only makes sense when read in a specific order. Reichel’s write-up includes a key that shows how to read the bytes, and each of Sleepwalker’s 23 instructions is written in this command language.

Some of the instructions carry an inner program. For example, a scheduler can also contain a network listener, with a routine that waits for a particular file to be assembled and checked before it will run on the compromised computer.

Beyond the two magic-packet sniffing instructions and basic instructions - such as an exit command that stops all running programs and the packet listener, and an instruction that starts a second, smaller program running concurrently with the parent program - the backdoor has multiple others.

These include four instructions on sending and hiding data. One of these opens a TCP connection to a chosen address and port, and then sends a block of data to a remote host, which can be a VMware VMCI target instead of a normal network address. Another one writes a block of data to a Windows named pipe on a chosen computer, and can optionally log in with a username and password first.

Five other instructions focus on inbound task reception, such as waiting to receive - or reaching out on its own - a follow-up instruction, opening a TCP or UDP port, or creating and/or connecting to a named pipe. 

Additionally, the malware has five different instructions on building and running programs.

A lot of unknowns…and detection tools

As Reichel notes, however, a lot remains unknown about Sleepwalker. “I have no collection context tying the file to a confirmed intrusion, so I cannot identify a victim, industry, country or affected organization,” he wrote. 

While we know that the DLL is designed to execute via side-loading after being placed beside ERAAgent.exe, we don't know how the malware operator first gained access to the computer or delivered the malicious file. We also don’t know the operator or developer, or what post-compromise activity, if any, took place.

“I found no related code that would support attribution to a known group, and this one sample cannot establish when or how widely Sleepwalker was deployed, whether variants exist or whether it belongs to a continuing campaign,” Reichel wrote.

Perhaps most importantly, for anyone who believes that they may be infected with Sleepwalker or a related malware sample, Reichel wrote, “I have created a toolkit to help decode its bytecode, examine encrypted and network artifacts, summarize behavior and indicators and safely reproduce its receiving pipeline without executing commands or transmitting traffic,” urging targeted individuals to contact him. 

He also created a mitigation guide, with a remediation script for use after Sleepwalker is detected.®