One of the most beloved Windows tools could actually be a huge security risk TechRadar Skip to main content TechRadar is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Here's why you can trust us. One of the most beloved Windows tools could actually be a huge security risk By Sead Fadilpašić published 25 July 2022 Windows calculator being abused to sideload Qbot (Image credit: Shutterstock) Audio player loading… Calculator, one of the most basic (and most useful) Windows tools, is being abused to load malware onto target endpoints (opens in new tab), researchers have found. ProxyLife experts discovered the Windows calculator tool can be used to infect the device with Qbot, a known malware dropper used to deliver Cobalt Strike beacons on targeted devices, which is often the first step in a ransomware attack. As usual, the attack starts with a phishing attempt. The threat actor will mail the victim, attaching an HTML file that, in turn, downloads a password-protected .ZIP archive. Being password-protected helps the payload avoid detection from antivirus (opens in new tab) programs. Extracting the .ZIP archive shows an .ISO file, a digital file format replicating a physical CD, DVD, or BD. Mounting the .ISO brings forth four files: two .DLL files (one of which is the Qbot malware), one shortcut (posing as the file the victim is supposed to open), and the calculator program (calc.exe). Running malicious DLLs The shortcut does nothing more than bring up the calculator, but here's the fun part: when the calculator starts, it will look for .DLL files needed to properly run. It won't look for them in specific folders, but rather first and foremost - in the same folder as the calc.exe. Which brings us back to the two .DLL files that the victim downloaded together with the Calculator.Read more> Hackers abusing this perfectly innocent Windows 10 feature to infect machines (opens in new tab) > New phishing campaign targeting US tax return payers ahead of 2021 deadline (opens in new tab) > Here's our take for the best secure email providers right now (opens in new tab) Running the calculator will trigger the first .DLL file, and that one will trigger the second, or in this case - the Qbot malware. The practice is also known as DLL side-loading. It is also worth mentioning that this attack does not work on Windows 10, or Windows 11 (opens in new tab), but works on Windows 7, which is why the threat actors bundle the Windows 7 version. The campaign has been active since July 11, and apparently, is still active at press time. These are the best firewall services (opens in new tab) right now Via: BleepingComputer (opens in new tab) Sead Fadilpašić Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he's written for numerous media outlets, including Al Jazeera Balkans. He's also held several modules on content writing for Represent Communications. See more Computing news Are you a pro? Subscribe to our newsletter Sign up to theTechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Thank you for signing up to TechRadar. You will receive a verification email shortly. There was a problem. Please refresh the page and try again. MOST POPULARMOST SHARED1PC gamers are shunning high-end GPUs – spelling trouble for the Nvidia RTX 40902It looks like Fallout's spiritual successor is getting a PS5 remaster3Samsung's smaller micro-LED 4K TV might finally be on the way to battle OLED4A whole new breed of SSDs is about to break through5New Anker wireless earbuds offer a feature AirPods Pro can't – and for cheaper1Con le RTX 4000 ho capito che Nvidia ha perso la testa2Canon's next mirrorless camera could be too cheap for its own good3PC gamers are shunning high-end GPUs – spelling trouble for the Nvidia RTX 40904IT pros suffer from serious misconceptions about Microsoft 365 security5A whole new breed of SSDs is about to break through Technology Magazines (opens in new tab)● (opens in new tab)The best tech tutorials and in-depth reviewsFrom$12.99 (opens in new tab)View (opens in new tab)