a fake resume invoked China’s defence-tech elite, then installed VShell 2026-08-27 :: Himanshu Anand :: 22 min read (4513 words) # malware # threat-intel # reverse-engineering # snowlight # vshell # any.run # China Table of Contents Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and conclusions are my own. I did not execute the malware locally. Local work was limited to archive extraction, parsing, disassembly and decoding traffic already captured by the sandbox. TLDR ⌗ I found a Chinese-language “resume” that is actually a Windows executable. It claims to come from a student at one of China’s Seven Sons of National Defence , opens a real Word document, which is nice of it and quietly delivers SNOWLIGHT and the VShell remote-access trojan , which is less nice. The chain is: A fake Beijing Institute of Technology graduate-school resume is opened. A custom Go loader checks for sandboxes, verifies the machine has at least four CPU cores and uses Beep as a sleep timer. It downloads and opens a genuine DOCX decoy so the victim sees the document they expected. It reflectively runs a 1,454-byte Windows SNOWLIGHT stager. SNOWLIGHT connects to 38.207.178[.]192:50812 , downloads 4.65 MB, XOR-decodes it with 0x99 and jumps into a fileless VShell RAT. What is it meant to do? Give an operator quiet, interactive access to a professor or research-lab workstation: command execution, file access, screen capture and a route further into the victim network. That is the most defensible objective. The malware proves remote access. The decoy tells us why that access was packaged as this particular document. The lure is most consistent with a mainland Chinese academic recipient , at moderate confidence. That describes the intended victim, not the attacker. Attribution is less exciting: this is best described as an unattributed actor using a mainland-China-oriented academic lure and the now widely available SNOWLIGHT/VShell ecosystem . The evidence does not establish the operator’s language, nationality, employer or government sponsor. UNC5174 is relevant history, not a conclusion. how this started ⌗ The sample appeared in ANY.RUN with a filename that translates roughly to: Beijing Institute of Technology_network engineering major_ fresh graduate_Zhang Yuguang_personal resume (2)(1).zip Inside the archive was an executable carrying nearly the same name. Windows hides known extensions by default, document icons remain a thing and humans remain human. This business model has survived more Windows releases than Internet Explorer. ANY.RUN gave it a 100/100 malicious score, labeled the process vshell and showed the executable launching cmd.exe , opening a DOCX in Word and talking to one IP in a Hong Kong-registered netblock over two ports. Public geolocation sources disagree about where the server was physically located, so the registration is the claim I can actually support. Public task: ANY.RUN analysis 8d27f4bf-ed8c-461d-96e6-86968464dd86 The obvious answer was “it is a RAT.” The useful question was what does each stage do and what does the combination tell us about the operator’s objective? So I took it apart. the document that was trying a little too hard ⌗ The malware downloads a real Word document from: http://38.207.178[.]192:50813/MySQL_LOG.txt It saves it as: C:\Windows\Temp\Beijing Institute of Technology_..._personal resume (2).docx Then it launches Word. The victim gets the thing they clicked for, while the interesting part continues in memory. At first glance it looks normal: Zhang Yuguang, male, Beijing Institute of Technology, class of 2026, network engineering. Then you read past the first paragraph. The education section says the major is Electrical Engineering and Automation , not Network Engineering. The grades field is blank. The honors say “delete as needed.” The certificates say “adjust as needed.” There is no phone number, email address, employer or verifiable internship. It is a three-page resume that forgot the small detail of telling the reader how to contact the applicant. The research interests are much more specific: AI-based power-grid fault diagnosis intelligent electrical systems renewable-energy converter control power-system automation joining “your research group” and completing experiments and papers This is not really a corporate job application. It reads like an unfinished template for contacting a prospective graduate supervisor . That changes the victim model. The named university is probably the applicant’s claimed school, not the target. The likely recipient is a professor or research group working on electrical engineering, energy systems or applied AI, possibly at another institution. the university name is doing a lot of work ⌗ Beijing Institute of Technology is not just a convenient university name copied from a rankings table. ASPI’s China Defence Universities Tracker categorizes BIT as one of the Seven Sons of National ...