New Windows Backdoor Can Hide Silently Until Hackers Activate It

Security researchers have discovered a previously unknown Windows backdoor that can stay hidden inside an infected computer until an attacker sends it a secret network signal.

Key points

• Add ProPakistani to Preferred Sources and see more of our stories in Google Search and Top Stories.
• Add as a preferredSource on Google Follow on Google News Join WhatsApp.
• Security researcher Dominik Reichel discovered Sleepwalker while examining a malware sample collected earlier.
• The malware is contained in a 64-bit Windows DLL file called dpapi.dll.
• The malware has its own small command system with 23 different instructions.

In practice, the malware, called Sleepwalker, is particularly dangerous since it does not behave like typical malware. It does not regularly contact an attacker's server or keep an obvious connection open. Instead, it quietly waits for a specially designed network packet before becoming active.

This could create infections harder to detect, especially for security systems that mainly look for suspicious connections between an infected computer and an attacker. AliExpress Caught Secretly Listening to Users for Fingerprinting. Sleepwalker Waits for a Secret Signal.

Meanwhile, the backdoor remains inactive until it receives a specific "magic packet." This is simply a specially designed network message that acts like a secret password, telling the malware to wake up.

Once the correct packet arrives, Sleepwalker activates and decrypts instructions from the attacker.

Notably, the malware has its own small command system with 23 different instructions. These allow an attacker to perform tasks such as transferring information, receiving extra malware, and running code on the infected computer.

Sleepwalker uses AES-256-CCM, a solid form of encryption, to protect these commands. Encryption scrambles information so that individuals without the correct key cannot easily read it.

Nevertheless, knowing the encryption key alone is not enough. Researchers additionally need to understand Sleepwalker's custom command system to determine exactly what instructions an attacker is sending. Dangerous Malware is Targeting Govt and Organizations in Pakistan. It Can Employ A number of Ways to Communicate.

Sleepwalker can communicate over a number of types of network connections, including TCP, UDP, and ICMP.

These are basic methods computers employ to send information throughout networks. It can additionally apply SMB named pipes, a Windows feature that allows programs to communicate with each other.

Meanwhile, the malware can even communicate between a VMware virtual machine and its main computer using VMware's VMCI technology. A virtual machine is essentially a computer running inside another computer.

Researchers additionally identified a mechanism that could allow Sleepwalker to employ DNS as a trigger. DNS is the system that helps computers find websites and other services on the internet. Nevertheless, this feature was not active in the sample that was analysed. Sleepwalker Disguises Itself as a Windows File.

Another concern is that Sleepwalker is designed to look like a legitimate Windows component.

Meanwhile, the malware is contained in a 64-bit Windows DLL file called dpapi.dll. DLLs are files containing code that Windows programs can employ to perform different tasks.

For context, the difficulty is that dpapi.dll is additionally the name of a legitimate Microsoft Windows component. This can create the malicious file harder to distinguish from a genuine system file.

Meanwhile, the malware additionally contains fake information claiming that it belongs to the ESET Management Agent, a legitimate security management program.

Sleepwalker is designed to employ a technique called DLL side-loading. In simple terms, this happens when a legitimate program is tricked into loading a malicious file instead of the genuine one.

Sleepwalker checks whether it has been loaded by ERAAgent.exe, a legitimate executable associated with ESET Management Agent. If it is not running in that program, it stays inactive.

If everything matches, the malware creates a background process, prepares computer memory for its instructions, and starts quietly monitoring network traffic for its secret activation signal. Why Sleepwalker Could Be Tough to Detect.

Most security systems look for signs such as an infected computer repeatedly connecting to a suspicious external server. Sleepwalker largely avoids this behaviour.

It does not need to regularly contact an attacker's server. Instead, it can remain hidden and wait for the right network packet. This means an infected computer could potentially remain compromised without producing some of the usual warning signs that security software looks for.

After receiving its activation signal, nevertheless, the malware can commence performing more dangerous actions. These can include transferring information, creating communication channels, receiving extra malicious programs, and running code directly in the computer's memory.

Running code in memory means the malware can execute instructions without necessarily creating a traditional file on the hard drive. This can create some types of security detection more challenging. Researchers Believe It May Be a Targeted Threat.

Reichel remarked Sleepwalker's design appears more consistent with a targeted and well-funded attack than ordinary malware that is distributed widely to as numerous victims as feasible.

Nevertheless, there is at present no confirmed information regarding who created the malware or who may have been targeted.

Researchers additionally do not know which countries or industries may have been affected. Only one Sleepwalker sample has been analysed so far, meaning there is still limited information regarding the wider operation.

Notably, the sample additionally contains a number of weaknesses. This suggests that the version examined by researchers could be an early version of the malware that may still be under development. Security Teams Can Check for Sleepwalker.

Reichel has published indicators of compromise (IOCs) to assist security teams look for signs that Sleepwalker may be present.

He has additionally published a YARA detection rule. It allows security researchers to search files for patterns associated with the malware.

For context, a read-only PowerShell scanner is additionally available to assist identify the specific Sleepwalker sample that was analysed. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover.

Technology and Automotive Specialist covering the latest cars, smartphones, AI breakthroughs, and.

Taken together, the developments around new Windows Backdoor Can Hide Silently Until Hackers Activate It point to a situation that is still moving, and the coming days should bring more clarity.