สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool Aggah

Threat Group Cards: A Threat Actor Encyclopedia

Tool: Aggah

Names	Aggah
Category	Malware
Type	Loader
Description	(DeepInstinct) Aggah is distributed by Microsoft Office documents with malicious VBA macros in them. In this campaign we have seen several PowerPoint presentations, some with Covid-19 related names, and others are invoices. The presentations are usually empty of content, besides a short and simple VBA macro that uses a StrReverse function to evade basic detection by AV products. Once opened it downloads the next stage of the malware via the “Shell” command.
Information	<https://www.deepinstinct.com/2020/05/25/aghast-at-aggah-teasing-security-controls-with-advanced-evasion-techniques/>

Last change to this tool card: 29 May 2020

Download this tool card in JSON format

All groups using tool Aggah

Changed	Name	Country	Observed
APT groups
	Aggah	[Unknown]	2018-Jun 2022

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]