Loading malware…
SLEEPWALKER is an unattributed 64-bit Windows passive backdoor and post-compromise implant designed for DLL side-loading into the ESET Management Agent. It impersonates a Microsoft data-protection library and remains dormant in the legitimate management-agent process until it detects a specially crafted network trigger. Rather than beaconing to fixed command-and-control infrastructure, it places network interfaces in promiscuous mode, validates trigger traffic, decrypts AES-256-CCM-protected tasking, and interprets a proprietary 23-instruction bytecode language. Its tasking supports scheduled and repeated execution, staged and integrity-verified payload assembly, decompression, direct in-memory shellcode execution, and communications over TCP, UDP, ICMP, SMB named pipes, raw packets, and VMware VMCI. The analyzed configuration enabled raw-packet triggering; DNS-based triggering was implemented but not enabled. SLEEPWALKER can alter Windows anonymous-access settings and create named pipes to facilitate unauthenticated pipe access, and can use supplied credentials for remote named-pipe communications. No threat actor, victim, campaign, initial-access vector, or confirmed operational deployment has been identified.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
“SLEEPWALKER supports 23 bytecode instructions for scheduling [and] repeated tasks.”
“The resulting data consists of a proprietary bytecode format interpreted by the malware.”
“SLEEPWALKER implements 23 instructions supporting ... Direct in-memory shellcode execution.”
“SLEEPWALKER supports 23 bytecode instructions for scheduling [and] repeated tasks.”
“It can create named pipes and use supplied credentials to communicate with other systems.”
“SLEEPWALKER supports 23 bytecode instructions for ... compressed payloads.”
“It is an unsigned 64-bit Windows library that imitates a legitimate supporting component” and “dpapi.dll [is an] Unsigned malicious DLL masquerading as a legitimate Microsoft component.”
Sleepwalker представляет собой неподписанную 64-битную DLL ... которая маскируется под системную библиотеку dpapi.dll ... Вредонос также содержит поддельные сведения о версии этого продукта.
“It can create named pipes and use supplied credentials to communicate with other systems.”
“It also supports TCP, UDP, ICMP, Windows named pipes, DNS-based tasking, and VMware VMCI communications.” The report states “DNS triggering ... [was] implemented in the code but [was] not shown to have been used.”
“It also supports TCP, UDP, ICMP, Windows named pipes, DNS-based tasking, and VMware VMCI communications.”
“SLEEPWALKER implements 23 instructions supporting ... Network listeners capable of receiving additional task programs [and] staged payload assembly with SHA-256 verification.”
Task programs carried in DNS labels... Base32 over AES-256-CCM. Base32 makes the encrypted envelope suitable for DNS labels.
“Once placed on a compromised device, it can sit inactive for an extended period, only responding when an operator sends a carefully formed network packet.”
“A valid packet clears framing checks and CRC-32 validation before its tasking is decrypted with AES-256-CCM.”
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A passive Windows backdoor loaded via DLL side-loading beside a legitimate management-agent component. It places interfaces in promiscuous mode and waits for an encrypted, CRC-validated trigger packet rather than beaconing to fixed C2 infrastructure. It supports bytecode tasking, multiple communications mechanisms, scheduling, payload handling, named pipes, and direct in-memory shellcode execution.
A passive 64-bit Windows DLL backdoor masquerading as dpapi.dll and side-loaded into ERAAgent.exe. It avoids autonomous beaconing and fixed C2 infrastructure, instead monitoring interfaces for encrypted trigger packets. It uses AES-256-CCM-protected proprietary bytecode tasking and supports raw-packet and DNS triggers, TCP/UDP/ICMP/SMB named-pipe/VMCI communications, staged payload delivery, scheduling, lateral movement, local encrypted task loading, and direct in-memory shellcode execution. It can also weaken Windows anonymous named-pipe controls by modifying EveryoneIncludesAnonymous and NullSessionPipes.
A Windows 64-bit DLL backdoor that masquerades as dpapi.dll and uses DLL side-loading via ERAAgent.exe. It passively monitors local network traffic for an AES-256-CCM-encrypted magic packet containing custom bytecode, avoiding normal outbound C2 traffic. Its 23-bytecode-instruction command language supports task scheduling, data transfer, chunked file retrieval, SHA-256 integrity checks, and in-memory code execution. It can communicate over TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can open TCP/UDP listeners after activation. The sample is positioned as a post-exploitation tool because an attacker requires local administrator privileges to place the malicious DLL beside ERAAgent.exe.
A 64-bit Windows backdoor that DLL side-loads through the ESET Management Agent, passively monitors network interfaces for encrypted, specially crafted trigger packets, and executes a compact command language. It has no hard-coded C2 infrastructure or initial beacon and can use TCP, UDP, ICMP, SMB named pipes, raw packets, VMCI, and potentially DNS for tasking. Post-trigger capabilities include memory-resident payload staging and execution, named-pipe creation, use of supplied credentials for communications, and modifications to Windows anonymous named-pipe/SMB-related settings that may facilitate lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.