Inside Silver Fox, Part 1: Payload Landing — the Invisible Loader Chain of Inno Setup and Pascal
Silver Fox APT wraps a malicious Pascal script inside an Inno Setup installer that performs environment reconnaissance, adds the entire C: drive to the Defender exclusion list, disables network adapters to block reporting, and then decrypts and drops the next-stage loader men.exe — this report reconstructs the landing stage of that seemingly normal installer.