Trend Micro detected a spam campaign that drops the same FlawedAmmyy RAT used by a Necurs module to install its final payload on bots under bank- and POS-related user domains. The spam campaign was also found abusing SettingContent-ms.