SLEEPWALKER Malware Uses Raw Packets, DNS and VMware VMCI for Covert Communications

A newly analyzed Windows backdoor named SLEEPWALKER uses a passive command-and-control model designed to evade conventional beaconing-based detections.

Raw-packet activation, DNS-based tasking support, VMware VMCI communications, named-pipe capabilities, and in-memory payload execution.

No threat actor, victim, delivery chain, or live campaign has yet been attributed to the malware.

SLEEPWALKER is an unsigned 64-bit Windows DLL masquerading as dpapi.dll.

The analyzed 59,904-byte sample copies version-resource metadata associated with ESET Management Agent, including ESET branding and version 11.2.2076.0, and is intended to be side-loaded into ERAAgent.exe.

Instead of contacting a hard-coded C2 server, the implant remains dormant inside a trusted ESET Management Agent process until it receives a specifically crafted and encrypted network trigger.

Before activating, the malicious DLL checks whether its host process is named ERAAgent.exe.

It validates only the process name, rather than verifying the executable path or digital signature, allowing the payload to operate inside a process normally associated with endpoint-management activity.

The implant can begin through DllMain or when one of seven forwarded DPAPI-related exports is invoked.

Once loaded, SLEEPWALKER launches a background thread, allocates a 128 KB buffer for staged task assembly, decrypts its embedded bootstrap configuration, and starts its internal interpreter.

The embedded configuration contains only one functional instruction: monitor all available interfaces indefinitely for a matching trigger packet.

Unlike typical remote-access trojans, SLEEPWALKER contains no fixed C2 domains, IP addresses, URLs, or built-in second-stage payload. It does not generate autonomous outbound traffic.

Polyswarm said in a report shared with GBhackers, the malware was discovered and analyzed by independent researcher Dominik Reichel, who described SLEEPWALKER as a targeted, likely well-resourced implant with a custom bytecode interpreter.

SLEEPWALKER Malware

Instead, it places available interfaces into promiscuous mode and inspects packet contents for a proprietary “magic packet” structure.

The trigger undergoes framing checks, length validation, CRC-32 verification, and AES-256-CCM decryption before the malware interprets the resulting data as an attacker-supplied program.

AES-256-CCM provides confidentiality and authentication, while the additional CRC-32 check allows the implant to discard malformed traffic before attempting decryption.

This approach creates a substantial visibility challenge. An infected endpoint may continue producing legitimate ESET Management Agent traffic while the malicious DLL remains silent.

Meaning defenders cannot rely solely on suspicious outbound connections, recurring beacons, or known malicious infrastructure to identify compromise.

After receiving a valid trigger, SLEEPWALKER executes a proprietary 23-instruction bytecode language rather than human-readable commands.

The instruction set supports fixed and randomized delays, scheduled execution, repeated tasks, staged payload assembly with SHA-256 verification, LZMA decompression, encrypted task loading from files, and direct in-memory shellcode execution.

Its networking functionality includes TCP, UDP, ICMP, SMB named pipes, raw packet listeners, and DNS-carried tasking.

DNS tasking uses Base32-encoded AES-256-CCM data within DNS labels, providing a mechanism to deliver encrypted task programs through DNS activity where direct inbound traffic may be restricted.

However, DNS triggering was implemented capability, not enabled in the analyzed sample’s bootstrap configuration.

SLEEPWALKER also supports VMware Virtual Machine Communication Interface, or VMCI, when an operator specifies a vm: destination.

VMCI enables communications between VMware guests or between a guest and host through the virtualization layer rather than a conventional network adapter, potentially reducing visibility in ordinary packet captures.

The malware can weaken Windows protections for unauthenticated named-pipe communications by enabling anonymous SMB-related settings and creating pipes accessible to Everyone and Anonymous Logon.

This behavior, alongside suspicious pipe creation and unexpected DLL files named dpapi.dll near ERAAgent.exe, offers defenders concrete hunting opportunities.

Security teams should prioritize behavioral monitoring around trusted management processes, DLL side-loading paths, anomalous promiscuous-mode activity, unexpected VMCI usage, and Windows configuration changes involving EveryoneIncludesAnonymous or NullSessionPipes.

SLEEPWALKER’s design reinforces that absence of malicious C2 traffic is not evidence of absence: a dormant passive implant may wait indefinitely until an operator can place a valid trigger packet on the victim network.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide