EVILLOADER [CVE-2024-7014]

[pinkman]

Evilloader is a downloader that allows attackers to download and execute additional malicious payloads on target systems. CVE-2024-7014 describes an update to the anti-analysis mechanisms of this module. A file with the ".htm" extension is disguised as a video and sent via the Telegram API, and while the user is waiting for the video, JavaScript code inside the HTML is actually executed.

The root cause of the vulnerability is that the ".htm" file format in the response to Telegram servers is perceived as a video. The ".htm" code fragment is opened in the browser under "content://". This is: content://org.telegram.messenger.provider/media/android/data/org.telegram.messenger/Telegram.povider/Telegram%20Video/4298942894727273.htm The content is opened, which allows the specified HTML page to be triggered and opened.
download:

To view the content, you need to Sign In or Register.

 

[iq_drake]

!

 

[duyhieuatk]

ok

 

[reydel]

thanks

 

[Okakh]

hm

 

[0xnu11ptr]

Evilloader is a downloader that allows attackers to download and execute additional malicious payloads on target systems. CVE-2024-7014 describes an update to the anti-analysis mechanisms of this module. A file with the ".htm" extension is disguised as a video and sent via the Telegram API, and while the user is waiting for the video, JavaScript code inside the HTML is actually executed.

The root cause of the vulnerability is that the ".htm" file format in the response to Telegram servers is perceived as a video. The ".htm" code fragment is opened in the browser under "content://". This is: content://org.telegram.messenger.provider/media/android/data/org.telegram.messenger/Telegram.povider/Telegram%20Video/4298942894727273.htm The content is opened, which allows the specified HTML page to be triggered and opened.
download: *** Hidden text: cannot be quoted. ***

ty

 

[owlmarket]

hm

 

[mlisaeff21]

Evilloader is a downloader that allows attackers to download and execute additional malicious payloads on target systems. CVE-2024-7014 describes an update to the anti-analysis mechanisms of this module. A file with the ".htm" extension is disguised as a video and sent via the Telegram API, and while the user is waiting for the video, JavaScript code inside the HTML is actually executed.

The root cause of the vulnerability is that the ".htm" file format in the response to Telegram servers is perceived as a video. The ".htm" code fragment is opened in the browser under "content://". This is: content://org.telegram.messenger.provider/media/android/data/org.telegram.messenger/Telegram.povider/Telegram%20Video/4298942894727273.htm The content is opened, which allows the specified HTML page to be triggered and opened.
download: *** Hidden text: cannot be quoted. ***

 

[Grals]

thanks

 

[CristalineX ys]

best

 

[maplestory33]

thanks

 

[leiwrpsh]

123

 

[revtron]

respect

 

[covid192021]

qwe

 

[Blazecrest]

+