Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

A newly discovered Windows backdoor, called SLEEPWALKER, remains dormant in memory until it receives a specially crafted network packet, at which point it executes commands. These commands are written in a custom 23-instruction language. The backdoor is a 64-bit Windows dynamic-link library that is unsigned and has a size of 59,904 bytes. It is designed to be side-loaded into a system. The SLEEPWALKER backdoor is a previously unreported malware. An independent malware researcher has documented this new threat.