Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

An independent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor. This sample is an unsigned 64-bit DLL that remains inert in memory until it receives a specifically crafted network packet. Once triggered, the backdoor executes commands written in its own unique 23-instruction language.