Spam Campaign Abusing SettingContent-ms Found Dropping Same FlawedAmmyy RAT Distributed by Necurs[html]
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/06/cyberrime-380x380.jpg 380w,
https://blog.trendmicro.com/trendlabs-security-intelligence/files/2018/06/cyberrime.jpg 400w" sizes="(max-width: 200px) 100vw, 200px" />
Trend Micro detected a spam campaign that drops the same FlawedAmmyy RAT (remote access tool) used by a Necurs module to install its final payload on bots under bank- and POS-related user domains. The spam campaign was also found abusing SettingContent-ms – an XML format shortcut file that opens
