--- title: QBot malware uses Windows Calculator to side-load attacks description: Security researchers have discovered that QBot malware is now using the legitimate Windows Calculator app for DLL side-loading attacks. The method continues to be used in current malspam campaigns. canonical_url: https://www.acronis.com/en/tru/posts/qbot-malware-uses-windows-calculator-to-side-load-attacks/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 29 July 2022 # QBot malware uses Windows Calculator to side-load attacks Security researchers have discovered that QBot malware is now using the legitimate Windows Calculator app for DLL side-loading attacks. The method continues to be used in current malspam campaigns. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=sGbnGyUeuDw) Security researchers have discovered that QBot malware is now using the legitimate Windows Calculator app for DLL side-loading attacks. The method continues to be used in current malspam campaigns. QBot is a Windows-targeting piece of malware that first started as a banking trojan in 2007, but has since evolved into a malware dropper that's often used by ransomware gangs. Some of the ransomware families that QBot is known to deliver include RansomExx, Maze, ProLock, Egregor and Black Basta. By installing QBot through a trusted program like the Windows Calculator, threat actors can evade detection from many traditional cybersecurity solutions. The Advanced Email Security pack for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) detects emails with malicious attachments or URLs and filters them automatically, preventing these threats from ever reaching users' inboxes. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)