Fake Student Resume = Malware Delivery Vector (SNOWLIGHT + VShell Breakdown)

Fake Student Resume = Malware Delivery Vector (SNOWLIGHT + VShell Breakdown)

A new campaign is using fake graduate-school resumes to drop fileless malware on researchers' Windows machines. Not HR teams — professors and lab staff in electrical engineering, energy systems, and applied AI.

The lure: ZIP archive disguised as a Beijing Institute of Technology grad application. Inside: an executable with a document-style name, exploiting Windows' default extension-hiding behavior. Open the "resume," launch the .exe.

The chain:

• Custom Go loader checks for 4+ CPU cores (anti-sandbox)
• Uses kernel32!Beep instead of Sleep() to detect accelerated VM timing
• Opens a genuine decoy DOCX so the victim sees nothing wrong
• Encrypted shellcode runs fully in memory — zero disk writes

That shellcode is SNOWLIGHT, a stager that decodes and hands off to a fileless build of VShell RAT — shell access, file transfer, screen capture, tunneling, all in-memory.

Attribution: deliberately narrow. Unattributed actor, mainland-China-oriented academic lure. SNOWLIGHT is now a default VShell-panel-generated stager, so tool overlap ≠ group ID.

Full writeup covers the complete attack chain, IOCs (hashes, C2 IP, AES/XOR keys), and PowerShell hunting commands for your SOC:

🔗 https://www.xpert4cyber.com/2026/08/fake-resume-malware-snowlight-vshell.html