SilverFox dispatcher blacklist evasion serving decoy WeChat installer
Detects network traffic where the SilverFox malware relay (api.php) attempts to evade detection by returning a legitimate WeChat installer download link as a decoy response, rather than its intended malicious payload, when communicating with external analysis environments.
YARA-L
