Executive Summary
SLEEPWALKER is a stealthy 64-bit Windows DLL backdoor that avoids traditional detection by operating entirely passively. Unlike most malware, it does not contact a fixed Command and Control (C2) server. Instead, it utilizes raw sockets to sniff network interfaces in promiscuous mode, waiting for a specifically crafted 'magic packet' to trigger its execution. Once activated, it interprets a custom, 23-instruction bytecode language supplied by the attacker, allowing for highly flexible and fileless malicious activity.
The malware primarily achieves persistence and execution through DLL side-loading, impersonating the Microsoft `dpapi.dll` and forges ESET Management Agent version resources to blend into the `ERAAgent.exe` process environment. Its design includes support for six distinct network transports, including covert VMware VMCI channels for guest-to-host communication and DNS-based triggering, though the raw packet listener is the default bootstrap configuration.
This implant represents a significant threat to managed Windows endpoints, particularly those utilizing ESET PROTECT. The absence of outbound beaconing and the use of authenticated AES-256-CCM encryption for its command language make it exceptionally difficult to detect via standard network monitoring. Security teams should prioritize hunting for anomalous DLLs in ESET application directories and monitoring for unauthorized changes to SMB/Named Pipe registry configurations.