Sleepwalker: Passive Backdoor with Its Own Command Language
Summary
Sleepwalker is a passive Windows backdoor that activates when loaded by ERAAgent.exe, featuring its own 23-instruction bytecode language, multi-channel transports (including DNS and VMware VMCI), and in-memory execution. The write-up includes a detailed lifecycle, indicators of compromise, and detection utilities for defenders.