Threat actor's collections
The collections relationship returns the list of all collections where the threat actor is in.
This relationship can be retrieved using the relationships API endpoint. The response contains a list of Collection objects.
{
"data": [
<COLLECTION_OBJECT>,
<COLLECTION_OBJECT>,
...
],
"links": {
"next": "<string>",
"self": "<string>"
},
"meta": {
"count": <int>,
"cursor": "<string>"
}
}
{
"meta": {
"count": 35,
"cursor": "eyJsaW1pdCI6IDEsICJvZmZzZXQiOiAxfQ=="
},
"data": [
{
"attributes": {
"status": "COMPUTED",
"description": "While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.\r\nIt is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.\r\nEmotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.",
"description_html": "While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.<br />It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.<br />Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.",
"tags": [],
"ip_addresses_count": 347,
"domains_count": 176,
"targeted_regions": [],
"top_icon_md5": [
"647ca034cb6c763363b636269047a4c0",
"116b33ba11a263321100e5212f16b8ce",
"e89a12aa65c100ed2a55e7996433a22a"
],
"creation_date": 1612569600,
"references_count": 241,
"alt_names": [
"Geodo",
"Heodo"
],
"threat_actors_count": 35,
"urls_count": 91,
"autogenerated_tags": [
"cve-2012-0188",
"cve-2014-3566",
],
"targeted_industries": [],
"last_modification_date": 1658298059,
"link": "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet",
"targeted_countries": [],
"files_count": 54742,
"name": "Emotet"
},
"type": "collection",
"id": "malpedia_win_emotet",
"links": {
"self": "https://www.virustotal.com/api/v3/collections/malpedia_win_emotet"
}
},
"links": {
"self": "https://virustotal.com/api/v3/threat_actors/1cb7e1cc-d695-42b1-92f4-fd0112a3c9be/collections?limit=1",
"next": "https://virustotal.com/api/v3/threat_actors/1cb7e1cc-d695-42b1-92f4-fd0112a3c9be/collections?cursor=eyJsaW1pdCI6IDEsICJvZmZzZXQiOiAxfQ%3D%3D&limit=1"
}
}