TLDR of the 2026 Attack:

Scinary investigated an incident where a malicious download bundled legitimate software with modified components. This report examines the results of their investigation, including the malware’s packaging, suspected DLL sideloading, and detection challenges faced.

This incident occurred when a user attempted to search online for ChatGPT. An observation of surrounding browser history implies the attackers utilized SEO-poisoning to push a Google Sites deployment hosting a ClickFix prompt to reach the top of search results.

A Threat Actor’s "Frankenstein"

Further looking into this ClickFix attack, the team identified an initial outbound command that called content from the foreign IP 151.240.151[.]223 (defined as a 32-bit integer in the image) to be saved as a PowerShell file and then executed:

Investigators then navigated to this IP in a sandboxed environment to further inspect, revealing code with multiple levels of obfuscation:

Deobfuscating this script reveals the attacker’s method of calling the main payload, "FilesInspectorX.msi", and defining further install instructions:

FilesInspectorX.msi (titled Innovative CP Notifier Pro upon install) combined components from legitimate applications with initially unknown content. The team found two seemingly legitimate pieces here, the program "Files Inspector" by ChemTable Software and many of its known imported files were seen present post-install (highlighted in the image below). Second, an executable file "sanotifier.exe" was found along with its expected imported DLL files, with some modifications and unexpected files being made clear later on.

Likely DLL Sideloading

The component sanotifier.exe, a legitimately signed SecureAge CatchPulse notifier, appears to be the main player here. Investigators identified three unsigned DLL files: “Qt5Widgets.dll”, “util4..dll” (with two dots), and “SMM_FrameStepper.dll”. Qt5Widgets.dll in the sample specifically stuck out to the team, as that was listed as a dependency for sanotifier.exe. These findings raised suspicion that these DLL files may have been repurposed to load attacker-controlled code.

The team inspected a ‘strings’ output of Qt5Widgets.dll, noticing util4..dll was appended to the bottom of the file. From there, it was found that util4..dll listed SMM_FrameStepper.dll, which appears to call functions such as “NtUserGetRawInputData”, a known Windows function often abused for its keylogging capabilities, and “InternetConnect”, identified as a likely avenue for the anomalous connections that sanotifier.exe was noted to have initiated in the next section.

The team also noted that both util4..dll and SMM_FrameStepper.dll had a compile timestamp for October 3rd 2026, only 2 days before this incident. With this information, it can be assumed that these two highlighted DLL files were modified by threat actors to potentially gather and exfiltrate sensitive user data through this legitimate executable.

Suspected C2 Communication

During the investigation, sanotifier.exe was seen establishing a TCP connection over port 443 to another high-risk hosting IP, 96.62.218[.]59:

ThreatDown’s process monitoring tool Flight Recorder reported outbound TCP traffic from sanotifier.exe to 96.62.218[.]59 over port 443, with no domain specified in the available records. Investigators noted this as suspected command-and-control (C2) communication, as the direct-to-IP communication over port 443 is a known tactic to bypass both firewall and DNS-based detection, and has seen increased adoption by threat actors.

The team probed 96.62.218[.]59 and found TCP port 443 open but obtained no application response to the NULL probe or other reported probes. Additionally, it was noted to refuse browser connection attempts with a status of 403.

TLS is the most likely explanation for traffic on port 443, but its use could not be confirmed. Sophos has documented malware using TLS to conceal payload delivery, data theft, and C2 communications. At the very least, plain HTTP communications were not present here and would be easily identifiable with our investigator’s available tools.

Detection Challenges

This incident presented several points for investigation: outbound PowerShell activity, obfuscated commands, unusual package composition, suspected DLL sideloading, and network activity attributed to sanotifier.exe. All of these were designed for defense evasion and presented challenges to the investigator’s toolsets for automated escalation.

At this time, there is no agreed determination on what or where the rule gaps were, however the method of delivery and execution appear to be fairly unique; obfuscating IPs as a 32-bit integer, using multiple levels of obfuscation on the MSI file download, and the method of using known signed files for execution would certainly pose a challenge.

The case illustrates the importance of evaluating these events together. A valid executable signature, a familiar library name, or traffic on port 443 cannot independently establish that the surrounding activity is legitimate. Here, the relationship between packaging, execution, and communication provides the strongest basis for assessing malicious intent.

Notable Indicators of Compromise

The presence of some legitimate components can cause issues when determining widely applicable Indicators of Compromise (IOCs), however the team’s investigation revealed a few outliers in this case:

Links to VirusTotal Reports:

sanotifier.exe

Qt5Widgets.dll

Report for 151.240.151[.]223

Report for 96.62.218[.]59

Articles Cited:

1. S. Wang, D. Liu, and Z. Chen, “Almost Half of Malware Samples Communicate Direct to IP,” Unit 42, Aug. 04, 2026.
2. “Nearly half of malware now use TLS to conceal communications,” Sophos, 2021.