SLEEPWALKER is an unsigned, 64-bit Windows DLL (59,904 bytes, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) built to be dropped alongside ERAAgent.exe, the executable for ESET's Management Agent (ESET PROTECT/ERA), and loaded via DLL side-loading -- its only persistence mechanism. It masquerades as Microsoft's genuine dpapi.dll, exporting the same seven DPAPI functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState, iCryptIdentifyProtection) as forwarding stubs to a non-existent dpapisvc.dll, and it carries a forged ESET Management Agent PE version resource (v11.2.2076.0) to pass casual inspection. The PE compile timestamp is 2024-06-10 09:18:27 UTC.

After loading, the malware validates that its host process is named ERAAgent.exe via runtime string reconstruction (not a hardcoded literal) before doing anything else -- a check that both confirms the intended deployment context and frustrates sandbox/analysis execution. It then places the network interface into promiscuous mode and passively inspects all traffic traversing the host, looking for a 'magic packet': candidate packets must be at least 48 bytes, pass an XOR-and-0xAAAA-derived length check, a byte-pair sum validation, and a CRC-32 check before the malware attempts an AES-256-CCM decryption (16-byte MAC tag) using a key and bootstrap nonce embedded in the sample. A parallel DNS-based trigger (present in the sample but not enabled at analysis time) carries the same AES-256-CCM envelope Base32-encoded inside DNS query labels, with a CRC-8 (polynomial 0x31) checksum splitting markers into the 'g'-'v' character range.

Decrypted payloads are bytecode programs for a proprietary 23-instruction command language (opcodes documented by the researcher from 0x06 through 0x88) covering process control (EXIT, SPAWN_THREAD_SCRIPT), scheduling/jitter (SLEEP_SECONDS, SLEEP_RANDOM_SECONDS, CRON_SCHEDULE, REPEAT_N, LOOP_FOREVER), outbound/inbound transport over TCP, UDP, ICMP, and named pipes, staged payload assembly with SHA-256 verification (STAGE_WRITE/STAGE_VERIFY_EXEC), LZMA-compressed payload execution (DECOMPRESS_RUN), and in-memory shellcode execution (RUN_SHELLCODE, which allocates writable memory, flips it executable via VirtualProtect, and runs attacker-supplied machine code inside the ERAAgent.exe process). The malware also supports VMware Virtual Machine Communication Interface (VMCI) channels for guest-to-host and guest-to-guest command transport, and for lateral movement it can enable unauthenticated SMB access by setting EveryoneIncludesAnonymous to 1 and adding an entry to NullSessionPipes, then creating named pipes with Everyone/Anonymous Logon full-control permissions. All cryptographic operations use a statically linked copy of mbedTLS rather than Windows CNG/CryptoAPI.

Because the backdoor never initiates outbound C2 traffic on its own, network-based detections built around known-bad domains/IPs will not observe it; defenders instead need endpoint indicators (an unexpected dpapi.dll/dpapisvc.dll pair beside ERAAgent.exe, the registry/named-pipe changes) and network sensors capable of recognizing the documented magic-packet framing pattern. No confirmed victims, delivery/initial-access vector, or threat-actor attribution have been established; the researcher characterizes the design as 'consistent with a targeted, well-resourced operation rather than an opportunistic one.' This is a distinct technique/target from the unrelated, already-patched ESET DLL search-order-hijacking flaw CVE-2024-11859 (ecls.exe / version.dll, exploited by ToddyCat and patched in January 2025) -- SLEEPWALKER targets ERAAgent.exe/dpapi.dll and no vendor advisory or CVE has been issued for it.