Published on August 29, 2026
Go Loader Uses Anti-Sandbox Techniques and SNOWLIGHT to Deliver Fileless VShell RAT
Severity
Medium
A Windows malware campaign is using a fake graduate-school resume to deliver the SNOWLIGHT stager and a fileless VShell remote-access trojan (RAT). The campaign appears to target users associated with Chinese academic and technical research environments.
The attack relies on a custom 32-bit Go-based loader that checks the execution environment for signs of sandboxing before deploying its payload. While the victim is shown a seemingly legitimate Word document, the loader silently establishes remote access by executing the malware directly in memory.
The malicious ZIP archive is named “Beijing Institute of Technology (BIT) graduate resume” and contains an executable disguised as a document. The filename roughly translates to a resume belonging to a newly graduated Network Engineering student from Beijing Institute of Technology.
The decoy resume contains references to AI-based power-grid fault diagnosis, intelligent electrical systems, renewable-energy converter control, and power-system automation. Its use of Simplified Chinese, China-specific education terminology, WPS Office metadata with locale 2052, and wording directed toward prospective supervisors or research groups indicates that the lure was likely created for a mainland Chinese academic environment.
The use of Beijing Institute of Technology’s name adds credibility to the document. However, there is no evidence that the university created, distributed, or was aware of the malicious file.
How?
The attack uses a custom 32-bit Go loader that performs sandbox checks, opens a legitimate-looking Word document as a decoy, and The first-stage payload is a 5 MB, 32-bit Go executable compiled with Go 1.22.0. It contains a nominal Kingsoft signature that fails validation, suggesting that the signature is intended to make the executable appear legitimate rather than provide a valid digital signature.
The loader performs several environment checks to identify analysis and sandbox environments. An internal function named AntiWeibu searches for a path associated with the Chinese ThreatBook/Weibu sandbox. It also checks the number of logical CPU cores and terminates if fewer than four are detected, helping it avoid execution in low-resource virtualized environments.
The malware also uses kernel32!Beep to perform a 10-second timing check instead of relying on the commonly monitored Sleep API. If the observed execution timing does not match the expected result, the loader stops execution.
Once the environment checks are passed, the loader processes its encrypted configuration through several decoding and decryption stages involving Base32hex, AES-CBC, PKCS#7, bitwise-NOT, and Base64 operations. It then retrieves a DOCX decoy and encrypted shellcode from 38.207.178[.]192:50813.
The downloaded document is saved to C:\Windows\Temp and opened using Microsoft Word to maintain the appearance of a legitimate resume. Meanwhile, the loader uses APIs including AllocADsMem, VirtualProtect, and CreateThread to execute the shellcode directly in memory.
The 1,454-byte shellcode is identified as belonging to the SNOWLIGHT stager family. It connects to 38.207.178[.]192:50812, determines the victim’s system architecture, allocates approximately 30 MB of executable memory, and retrieves the next-stage payload. The payload is XOR-decoded using 0x99 before execution, allowing the malware to proceed without creating a conventional payload file on disk.
The final stage is a 4.65 MB 32-bit Go-based PE payload identified as VShell through static and network analysis. VShell provides attackers with remote-access capabilities including interactive command execution, file browsing and transfer, screenshot capture, host reconnaissance, tunneling, and reverse-proxy functionality.
The use of SNOWLIGHT and VShell has similarities to activity previously associated with UNC5174 and other China-linked threat clusters. However, SNOWLIGHT is publicly available and has been observed in multiple campaigns, including activity attributed to UAT-8302. Therefore, the use of SNOWLIGHT alone does not provide sufficient evidence to attribute the campaign to a specific threat actor.
Based on the available evidence, the activity is best assessed as an unattributed campaign using a mainland-China-focused academic lure together with the publicly accessible SNOWLIGHT and VShell malware ecosystem.
The malware ultimately provides attackers with interactive remote access to compromised research workstations. This access could allow further credential theft, data collection, or lateral movement if the compromised system is considered valuable.
IOCs
| Artifact | SHA-256 | MD5 |
|---|---|---|
| Original archive | c25d4412f7f93e7de5b2aaf41747175d94cffd983ca20efbd0efcdd718b58c4d | — |
| Go loader | 81c51138d5527ca7dcc258171eb36659c479f66c86a8947b6340d040b3860a30 | a7cc7e3cdd2f0f9210044911a483fa5d |
| Encrypted HTTP response | f6d4da5afc89bf9e536a9002c4d256c696df2389d77279f4c5daf6979557e74e | — |
Source