FuriaHubSleepwalker is a quiet Windows backdoor that waits for a magic packet
Dominik Reichel described a 64-bit DLL that impersonates dpapi.dll and side-loads into ESET’s ERAAgent.exe. It has no default beacon and can exfiltrate over VMware VMCI.
On August 24 The Register reported researcher Dominik Reichel’s analysis of Sleepwalker, a 64-bit Windows DLL that impersonates dpapi.dll and side-loads into ESET’s ERAAgent.exe. It waits for a magic packet and has no default beacon. Reichel released a decoder and a remediation script. There is no victim context and no attribution.
What we know
- The 64-bit Windows DLL impersonates dpapi.dll and side-loads into ESET ERAAgent.exe.
- It waits for a magic packet and has no default beacon.
- Command traffic uses AES-256-CCM and a custom 23-instruction language.
- The implant can exfiltrate data over VMware VMCI.
- Reichel released a decoder and a remediation script; there is no victim context or attribution.
Takeaways
- The backdoor hides behind a legitimate DLL name and an ESET process.
- No beacon means idle implants will not show up in typical C2 hunts.
- VMCI exfil is a path that never leaves the hypervisor’s internal channel.
Source: The Register
