Security researchers have discovered a previously unknown Windows backdoor that can stay hidden inside an infected computer until an attacker sends it a secret network signal.
The malware, called Sleepwalker, is particularly dangerous because it does not behave like typical malware. It does not regularly contact an attacker’s server or keep an obvious connection open. Instead, it quietly waits for a specially designed network packet before becoming active.
This could make infections harder to detect, especially for security systems that mainly look for suspicious connections between an infected computer and an attacker.
Sleepwalker Waits for a Secret Signal
Security researcher Dominik Reichel discovered Sleepwalker while examining a malware sample collected earlier.
The backdoor remains inactive until it receives a specific “magic packet.” This is simply a specially designed network message that acts like a secret password, telling the malware to wake up.
Once the correct packet arrives, Sleepwalker activates and decrypts instructions from the attacker.
The malware has its own small command system with 23 different instructions. These allow an attacker to perform tasks such as transferring information, receiving additional malware, and running code on the infected computer.
Sleepwalker uses AES-256-CCM, a strong form of encryption, to protect these commands. Encryption scrambles information so that people without the correct key cannot easily read it.
However, knowing the encryption key alone is not enough. Researchers also need to understand Sleepwalker’s custom command system to determine exactly what instructions an attacker is sending.
It Can Use Several Ways to Communicate
Sleepwalker can communicate over several types of network connections, including TCP, UDP, and ICMP.
These are basic methods computers use to send information across networks. It can also use SMB named pipes, a Windows feature that allows programs to communicate with each other.
The malware can even communicate between a VMware virtual machine and its main computer using VMware’s VMCI technology. A virtual machine is essentially a computer running inside another computer.
Researchers also found a mechanism that could allow Sleepwalker to use DNS as a trigger. DNS is the system that helps computers find websites and other services on the internet. However, this feature was not active in the sample that was analysed.
Sleepwalker Disguises Itself as a Windows File
Another concern is that Sleepwalker is designed to look like a legitimate Windows component.
The malware is contained in a 64-bit Windows DLL file called dpapi.dll. DLLs are files containing code that Windows programs can use to perform different tasks.
The problem is that dpapi.dll is also the name of a legitimate Microsoft Windows component. This can make the malicious file harder to distinguish from a genuine system file.
The malware also contains fake information claiming that it belongs to the ESET Management Agent, a legitimate security management program.
Sleepwalker is designed to use a technique called DLL side-loading. In simple terms, this happens when a legitimate program is tricked into loading a malicious file instead of the genuine one.
Sleepwalker checks whether it has been loaded by ERAAgent.exe, a legitimate executable associated with ESET Management Agent. If it is not running in that program, it stays inactive.
If everything matches, the malware creates a background process, prepares computer memory for its instructions, and starts quietly monitoring network traffic for its secret activation signal.
Why Sleepwalker Could Be Difficult to Detect
Most security systems look for signs such as an infected computer repeatedly connecting to a suspicious external server.
Sleepwalker largely avoids this behaviour.
It does not need to regularly contact an attacker’s server. Instead, it can remain hidden and wait for the right network packet. This means an infected computer could potentially remain compromised without producing some of the usual warning signs that security software looks for.
After receiving its activation signal, however, the malware can begin performing more dangerous actions. These can include transferring information, creating communication channels, receiving additional malicious programs, and running code directly in the computer’s memory.
Running code in memory means the malware can execute instructions without necessarily creating a traditional file on the hard drive. This can make some types of security detection more difficult.
Researchers Believe It May Be a Targeted Threat
Reichel said Sleepwalker’s design appears more consistent with a targeted and well-funded attack than ordinary malware that is distributed widely to as many victims as possible.
However, there is currently no confirmed information about who created the malware or who may have been targeted.
Researchers also do not know which countries or industries may have been affected. Only one Sleepwalker sample has been analysed so far, meaning there is still limited information about the wider operation.
The sample also contains several weaknesses. This suggests that the version examined by researchers could be an early version of the malware that may still be under development.
Security Teams Can Check for Sleepwalker
Reichel has released indicators of compromise (IOCs) to help security teams look for signs that Sleepwalker may be present.
He has also published a YARA detection rule, which allows security researchers to search files for patterns associated with the malware.
A read-only PowerShell scanner is also available to help identify the specific Sleepwalker sample that was analysed.
The post New Windows Backdoor Can Hide Silently Until Hackers Activate It appeared first on ProPakistani.
