Fake Student Resume Malware: Inside the SNOWLIGHT-to-VShell Attack Hitting Researchers
A professor opens what looks like a routine graduate-school application. The resume reads fine, the Word document loads, everything checks out. What the professor doesn't see is a Go-based loader quietly checking CPU core count, timing a fake sandbox test, and reaching out to a command server in the background. By the time the decoy document finishes rendering, the attacker already has a foothold.
This isn't a hypothetical. It's the exact chain researcher Himanshu Anand documented after analyzing a malicious ZIP archive disguised as a Beijing Institute of Technology graduate application. The payload: SNOWLIGHT and a fileless build of the VShell remote access trojan. The target: research workstations, not HR inboxes.
If your organization runs an academic partnership program, a research lab, or even just accepts unsolicited applications from external contacts, this campaign is worth fifteen minutes of your attention.
Table of Contents
- What Happened: The Fake Resume Campaign
- The Attack Chain, Step by Step
- How SNOWLIGHT Hands Off to VShell
- Indicators of Compromise (IOCs)
- Detection Commands for SOC Teams
- Prevention and Hardening Steps
- Expert Tips
- Related Reading
- FAQ
- Conclusion
What Happened: The Fake Resume Campaign
The lure archive carries a Chinese-language filename that translates roughly to "Beijing Institute of Technology network engineering major, fresh graduate, Zhang Yuguang, personal resume." Inside sits an executable with a near-identical, document-styled name — a trick that works because Windows hides known file extensions by default. Open what looks like a .docx, and you're actually launching a .exe.
The resume content itself claims the applicant is interested in AI-driven power-grid fault diagnosis, renewable-energy control systems, and joining a professor's research group. That's not generic phishing copy. It's tailored bait built specifically for electrical engineering and applied AI researchers, which points to professors and laboratory staff — not corporate recruiters — as the intended victims.
Analysis of the sample was conducted using ANY.RUN sandbox telemetry, without executing the malware on a live host. That distinction matters for anyone trying to reproduce or validate these findings safely.
The Attack Chain, Step by Step
Here's the sequence, broken down the way you'd walk it through in an incident review:
- Delivery: A ZIP archive arrives via email or a research-networking channel, posing as a graduate application.
- Execution: The victim runs the disguised executable, believing it's a Word document.
- Sandbox evasion: A custom 32-bit Go loader checks for at least four logical CPU cores. Fewer than four, and it exits — a classic signal that the environment is a resource-constrained analysis VM.
- Timing evasion: Instead of calling the commonly monitored
SleepAPI, the loader dynamically resolveskernel32!Beepand invokes it for ten seconds. If the elapsed wall-clock time doesn't match expectations — a sign of sandbox time acceleration — execution halts. - Decoy delivery: The loader retrieves and opens a genuine DOCX resume, so the victim sees exactly what they expected to see.
- Payload staging: In parallel, it downloads encrypted shellcode from the command server and runs it directly in memory — no file ever touches disk.
That last point is the one worth pausing on. Traditional antivirus scanning that relies on disk-based file inspection has very little to work with here.
How SNOWLIGHT Hands Off to VShell
The in-memory shellcode is SNOWLIGHT, a Windows stager that checks in with the command-and-control server and receives a 4.65 MB payload. SNOWLIGHT decodes that payload and hands execution to VShell, which then registers with the same server over encrypted traffic.
At that point, the attacker has a working remote-access channel. The analyzed sample completed VShell's registration and health-check sequence, but the capture didn't include an operator actually issuing commands, pulling files, or pivoting to another host. That's an important distinction for anyone writing this up in a threat report: confirmed behavior (successful RAT registration) is not the same as demonstrated behavior (active post-exploitation).
VShell itself isn't new or exclusive to this campaign. It's a widely available framework capable of an interactive command shell, file transfer, screen capture, network discovery, and tunneling. SNOWLIGHT, similarly, functions as a default stager generated by the VShell management panel — meaning the presence of these two tools together doesn't automatically point to one specific threat actor. Multiple clusters have used this same tool pairing over the past year, and cracked or leaked panel builds have made both components broadly accessible.
Attribution here stays deliberately narrow: an unattributed actor using a mainland-China-oriented academic lure. The lure's content and targeting suggest a mainland Chinese academic recipient was the intended context, but that describes the victim profile, not the operator's identity, nationality, or sponsor.
Indicators of Compromise (IOCs)
| Type | Indicator | Description |
|---|---|---|
| Archive filename | Beijing Institute of Technology_network engineering major_fresh graduate_Zhang Yuguang_personal resume (2)(1).zip | Malicious delivery archive |
| SHA-256 | c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d | Original malicious archive |
| SHA-256 | 81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30 | Go loader |
| MD5 | a7cc7e3cdd2f0f9210044911a483fa5d | Go loader |
| SHA-256 | f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e | Encrypted HTTP response |
| SHA-256 | 0524619d2471d77aba4b7993f5ffbaa4b8be6d2c0d91e63a02943851dc4b6404 | SNOWLIGHT shellcode |
| SHA-256 | ed2eaa6ef3eda95383b6efc35b88acbca742ad7bd118931f74727a3139ff7e97 | XOR-encoded VShell payload stream |
| SHA-256 | c666ac4f1a1b8df7ccfe8b19705279acd8b7eb7a4d0b3802bb3465064883ab25 | Decoded VShell payload |
| SHA-256 | de3f56d0d5b71f2a1a1905f0b01b84fbab237e9d4c5179a05b127d806823f83c | DOCX resume decoy |
| IP address | 38.207.178[.]192 | Command-and-control / staging server |
| URL | hxxp://38.207.178[.]192:50813/EasyConnectUpdata_Log.txt | Encrypted shellcode staging location |
| URL | hxxp://38.207.178[.]192:50813/MySQL_LOG.txt | Word document decoy staging location |
| Network service | 38.207.178[.]192:50813 | HTTP staging service |
| Network service | 38.207.178[.]192:50812 | SNOWLIGHT check-in and VShell transfer service |
| AES key | YtWzxwZimsZoeMen | Embedded loader configuration decryption key |
| XOR key | 0x99 | Key used to decode the received VShell payload |
| Filename | TEMPde.log | SNOWLIGHT kill-switch / operator exclusion marker |
Note: IP addresses are defanged with [.] to prevent accidental resolution. Re-fang only inside controlled platforms like your SIEM, VirusTotal, or MISP.
Detection Commands for SOC Teams
Start hunting by looking for the specific artifacts this chain leaves behind — the kill-switch file, outbound traffic to the staging IP, and resume-themed executables masquerading as documents.
Check for the kill-switch marker file across endpoints:
Get-ChildItem -Path C:\Users\ -Recurse -Filter "TEMPde.log" -ErrorAction SilentlyContinueWhat it does: searches user profile directories for the SNOWLIGHT exclusion marker. When to use it: as a quick sweep across endpoints during triage. Expected output: file paths if present, empty result if clean.
Hunt for outbound connections to the known staging infrastructure:
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq "38.207.178.192" }What it does: lists active TCP connections to the flagged C2 IP. When to use it: on any host suspected of running the loader. Expected output: connection details including remote port (50812 or 50813) if compromised.
Check whether hidden file extensions are enabled organization-wide (a core reason this lure works):
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name HideFileExtWhat it does: reads the registry value controlling extension visibility. When to use it: as part of a baseline audit before pushing a GPO fix. Expected output: a value of 1 means extensions are hidden (risk); 0 means visible.
For endpoints with Sysmon deployed, hunt Event ID 1 (process creation) for a Word process spawned by a non-Office parent, and Event ID 3 (network connection) for connections to the C2 ports — these two, correlated by timestamp and process GUID, are the clearest signal of this chain in telemetry.
Prevention and Hardening Steps
- Verify unsolicited applications out-of-band. A quick call or a message through a separate, known channel before opening any attachment from an unfamiliar applicant closes most of this attack's window.
- Force visible file extensions across managed endpoints via Group Policy. This single setting undermines the entire disguise mechanism.
- Block executable content inside unexpected archives at the email gateway or endpoint DLP layer, especially ZIP files containing .exe payloads with document-style icons.
- Flag resume-themed processes that spawn command shells, launch Word unexpectedly, or generate unusual outbound connections shortly after execution.
- Apply application allowlisting in research labs and academic departments where users regularly handle unsolicited external files.
- Feed the published IOCs into your SIEM and EDR now, rather than waiting for a formal advisory — this campaign is active and the infrastructure is live.
Expert Tips
Treat academic and research departments with the same phishing-awareness rigor you'd apply to HR or finance teams. Attackers have clearly recognized that professors and lab staff review unfamiliar files as a normal part of their job — that expectation is exactly what this lure exploits.
Don't over-attribute. SNOWLIGHT is now a default stager generated by the VShell management panel itself, meaning any operator with access to a cracked or leaked panel can produce a near-identical sample. Seeing "SNOWLIGHT + VShell" in your telemetry tells you the tool family, not the threat actor — build your report around behavior and IOCs, not a group name you can't support with evidence.
Separate confirmed capability from confirmed activity in every write-up. This sample proved VShell could register and pass health checks; it did not prove an operator executed hands-on-keyboard actions. That distinction keeps your incident report defensible.
Related Cybersecurity Topics You Should Explore
- 8.7M Airport Customers Breached — Are You One of Them?
- Claude Code Opus 5 Auto Mode Hijacked via Prompt Injection Attack
- A Broken Bluetooth Headset Exposed AliExpress's Secret Tracker
- ToxNetV2: The Linux Botnet That Asks AI Before It Attacks
- Tata Nexarc Account Takeover Bug: All It Took Was a Phone Number
- Zscaler Client Connector Flaw Lets Hackers Run Code Remotely
- 91 Spring CVEs Impact 209,000+ Components — Critical RCE Flaw Found
- SynkLoader Malware Fakes Windows Lock Screen to Steal Passwords
- SysScan Scam: Fake Microsoft Alert Tricks Users Into Deleting AV
- 768 Leaked AWS Keys Still Have Full Admin Access in 2026
- Enable Maximum Windows Logging for SOC & Ransomware Detection
- OpenBin.ai & OpenAPK.ai Review: Free AI Reverse Engineering Tool
- Grok Zero-Click Hack Steals Your Chats — No Click Needed
- head Command in Linux: Fast Log Triage for SOC Analysts
- Elementor Pro Bug Lets Hackers Upload PHP — No Login Needed
FAQ
Q: What is SNOWLIGHT malware?
A: SNOWLIGHT is a stager — a small piece of code whose job is to fetch and load a larger payload, in this case VShell, directly into memory rather than saving it to disk.
Q: What is VShell RAT?
A: VShell is a remote access trojan capable of an interactive shell, file transfer, screen capture, network discovery, and tunneling, and it can run entirely fileless.
Q: How does the fake resume file trick victims?
A: It relies on Windows hiding known file extensions by default, so an executable with a document-style name appears to be a harmless .docx file.
Q: Is this attack attributed to a specific state or group?
A: No. The evidence supports an unattributed actor using a mainland-China-oriented academic lure, not a confirmed state-linked operation.
Q: Who is actually being targeted?
A: The lure content targets professors, lab staff, and researchers working in electrical engineering, energy systems, and applied AI — not general corporate employees.
Q: How can I tell if my organization is affected?
A: Check for the TEMPde.log marker file, look for outbound connections to 38.207.178[.]192, and review any recent unsolicited "resume" archives received by research staff.
Q: Does antivirus catch this?
A: Traditional signature and disk-scan-based antivirus struggles here because the final payload runs entirely in memory. Behavioral EDR and network-based detection are far more effective.
Conclusion
This campaign is a reminder that social engineering doesn't need to be flashy — it just needs to match what the target already expects to receive. A resume, opened by someone whose job is to review resumes, is about as low-friction as an attack chain gets.
Pull the IOCs into your detection stack today, push the extension-visibility policy if you haven't already, and make sure your research and academic-facing teams know that "verify before you open" applies to them just as much as it does to HR.
Found this breakdown useful? Share it with your SOC team, drop your detection findings in the comments, and subscribe for the next threat breakdown as soon as it drops.