A Windows backdoor silently waits in memory for a 'magic packet' before activating. It doesn't do anything else, it just waits
A previously unseen Windows backdoor, dubbed Sleepwalker, silently waits in memory for a specially crafted network packet to wake it up and deliver 23 malware commands. The commands can do everything from execute code directly in memory to move data off the computer.
Researcher Dominik Reichel discovered the passive backdoor (Sleepwalker), which also has its own command language, and described it in detail in a technical analysis on Monday.
“What’s worth mentioning is what this packet carries: not a human-readable command, but a short program written in a script language designed by the backdoor ,” Reichel writes. “Its 23 instructions involve programming, various ways to move data, incrementally deliver files, and execute code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal script language must also be reverse engineered.”
In addition to having its own command language, it is notable that the remote host can be a VMware VMCI target instead of a regular network address. “Overall, the approach here is consistent with a targeted, well-equipped operation rather than an opportunistic one,” Reichel writes. The malware, hidden inside a 64-bit Windows DLL file, mimics Microsoft’s dpapi.dll, part of the Windows Data Protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll, but attempts to forward calls to a file named dpapisvc.dll, which is not a real Windows component. The file also contains a spoofed ESET Management Agent and is side-loaded into ERAgent.exe, the Windows executable for the ESET Management Agent. After confirming that its host process is called ERAAgent.exe, Sleepwalker enters a sleep state within the computer's memory, which helps it remain hidden from antivirus tools.
Unlike most backdoors, which attempt to communicate with a command-and-control server controlled by the attacker to receive commands, Sleepwalker sits in wait, checking every packet that passes through the network for a specific pattern – this is called a magic packet. Once it finds a packet that matches the exact pattern, the backdoor decrypts its data and uses it as commands.
“Because the backdoor never sends anything on its own and doesn’t open any obvious ports by default, tools that monitor connections to known bad domains or any unusual outbound traffic won’t see anything unusual,” Reichel says.
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
