SLEEPWALKER is a Windows backdoor built to stay quiet until an operator sends a specially crafted network packet. Rather than calling home to a fixed command server, it hides inside a trusted management process and waits, creating little network activity for defenders to spot.
The malware uses DLL side-loading, which makes a legitimate program load a malicious supporting file placed beside it.
It has appeared in recent Windows sideloading attacks, but SLEEPWALKER adds a passive trigger and a custom language for later commands. Analysts at R136a1 identified the malware after examining an unremarkable sample.
The evidence points to a targeted intrusion rather than a broad spam campaign. It must be placed beside the management agent and usually needs an attacker able to reach the victim network, but it can then receive tasks, move data, and run code in memory.
New Windows Backdoor
SLEEPWALKER is a 64-bit Windows library masquerading as a component of the ESET Management Agent. When the agent process starts, the malicious library checks only the host process name.
If it does, it starts a worker, decrypts its startup instruction, and begins watching network traffic. The built-in instruction tells the implant to monitor every available network interface indefinitely.
It does not open a visible listening port or send an initial beacon, unlike the activity described in this Mistic in-memory backdoor report. The genuine management software can continue ordinary activity. This complicates early incident response.
The trigger is checked against several conditions, including packet length, checksums, and encryption. A failed check produces no reply.
A valid packet is decrypted and passed to a compact interpreter, with 23 instructions for scheduling, staging, communications, and memory-only execution.
This limits detections based on suspicious domains or unusual outbound connections. A clean traffic record does not rule out a compromise because the implant can wait silently for a command. The report found no hard-coded command server, domain, or URL in the examined sample.
Hidden Commands and Risk
Once activated, the backdoor can receive follow-up tasks through TCP, UDP, ICMP, SMB named pipes, raw packets, or VMware’s VMCI channel.
VMCI passes communications between virtual machines and a host without traversing a physical network adapter. Similar efforts to blend remote control into trusted software appeared in the C2Looper update mechanism.
The malware also contains a DNS-based trigger capability, although it was not enabled in the analyzed startup configuration.
If used in another build or a later task, specially formatted DNS queries could carry encrypted instructions through networks that allow DNS while restricting other traffic. This makes unusual DNS patterns worth reviewing.
Its post-trigger options raise the risk further. SLEEPWALKER can stage memory-resident code, verify it with a cryptographic hash, and run it without placing a ready-made payload on disk.
It can create named pipes and use supplied credentials to communicate with other systems, opening a possible path for lateral movement.
.webp)
The implant weakens local protections to make anonymous named-pipe access easier. It changes Windows settings and attempts to reverse them later, although the report warns cleanup may remove a setting that existed before the malware ran.
These changes require administrator rights, so the sample does not show a way to gain elevated access itself.
Organizations should investigate library loading from management-agent folders, validate file signatures and hashes, and compare anonymous SMB and named-pipe settings with approved baselines.
Teams should also monitor raw-packet capture, interface monitoring, and suspicious process-side library loads, lessons reinforced by the HoneyMyte sideloading backdoor case.
R136a1 released a detection rule and a read-only PowerShell scanner that checks known file and configuration artifacts.
Since the analysis covers one binary without incident telemetry, the delivery method, infrastructure, victims, and attacker remain unknown. Still, its quiet activation model makes rapid hunting and containment prudent when the listed indicators appear.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 |
SHA-256 hash of the analyzed SLEEPWALKER sample |
| File placement | dpapi.dll beside ERAAgent.exe |
Unexpected DLL placement associated with the side-loading chain |
| File name | dpapisvc.dll |
Unexpected companion DLL name referenced by the malware |
| Registry value | EveryoneIncludesAnonymous = 1 |
Setting changed to make permissions granted to Everyone apply to anonymous access tokens |
| Registry value | Unexpected entry in NullSessionPipes |
May permit unauthenticated access to a named pipe; compare with a known-good baseline |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.