Emotet
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under threat actors.
Search every workspace for Emotet. It matches the name as written, so it can find other things that share it.
The items that name it 2
Sample analyzed: Win32.Emotet.zip, an encrypted ZIP containing an EXE payload; YARA matches indicated anti-debugging (SEH) techniques and VB5/6 compilation artifacts
All threat actors in this workspace.