VShell Malware Delivered Through a Fake Resume Targeting China’s Defense Industry

Summary

An unattributed threat actor used a fake academic resume linked to the Beijing Institute of Technology to deliver a multi-stage malware chain. The attack relies on a custom Go loader to deploy the SNOWLIGHT stager, which ultimately installs the VShell remote access trojan (RAT). The campaign targets research-focused environments, particularly organizations working in AI and energy systems.

Investigation

The investigation involved reverse-engineering the Go-based loader and examining network traffic captured in a sandbox environment. Researchers identified several evasion techniques, including CPU core checks and timing-based sleep detection. Analysis of the resulting PCAP also revealed VShell’s characteristic protocol behavior, including its registration and heartbeat sequence.

Mitigation

Organizations should enforce strict controls on executing unexpected files, especially those disguised as legitimate documents. Endpoint detection should monitor suspicious memory protection changes such as VirtualProtect and unusual outbound TCP traffic. Network monitoring should also flag connections to known malicious IP addresses or non-standard ports associated with VShell activity.

Response

If malicious activity is detected, the affected workstation should be isolated immediately to stop further command-and-control (C2) communication. Responders should perform memory forensics to identify fileless components and search for kill-switch markers such as %TEMP%\log_de.log. Network logs should also be reviewed for evidence of lateral movement or data exfiltration through VShell channels.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary delivers a weaponized “Resume.exe”. Upon execution, the malware initiates a command shell to download a secondary payload (a legitimate-looking .docx file) into C:WindowsTemp to masquerade as a system file. To evade sandbox environments that accelerate sleep timers, the malware calls the Beep function to create a hardware-based delay. This specific sequence is designed to trigger the detection rule.

• Regression Test Script:

  # Simulation Script for VShell RAT Delivery Pattern
  # NOTE: This script simulates the behavior of the malware to trigger the rule.
  
  # 1. Create a dummy malware executable at the path expected by the rule
  $malwarePath = "C:Pathtomalware.exe"
  $malwareDir = Split-Path $malwarePath
  if (!(Test-Path $malwareDir)) { New-Item -ItemType Directory -Path $malwareDir -Force }
  
  # Create a dummy file to act as the 'malware'
  New-Item -Path $malwarePath -ItemType File -Force
  
  # 2. Simulate the Malware Execution and the subsequent chain
  # We use PowerShell to mimic the malware's logic: spawn cmd, download file, call Beep
  Start-Process -FilePath $malwarePath -ArgumentList "/simulate" -Wait -ErrorAction SilentlyContinue
  
  # Logic being simulated:
  # a) Spawn cmd.exe
  # b) Download a .docx to C:WindowsTemp
  # c) Call the Beep function
  
  Start-Process "cmd.exe" -ArgumentList "/c powershell -Command `"Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/microsoft/Windows-Sysinternals/master/README.md' -OutFile 'C:WindowsTempfake_resume.docx'; [void][System.Console]::Beep(440,500)`""

• Cleanup Commands:

  # Cleanup script to remove simulated artifacts
  Remove-Item -Path "C:Pathtomalware.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "C:WindowsTempfake_resume.docx" -Force -ErrorAction SilentlyContinue
  if (Test-Path "C:Pathto") { Remove-Item -Path "C:Pathto" -Recurse -Force -ErrorAction SilentlyContinue }