JustAskJacky Node.js Trojan

What happened: Red Canary documented JustAskJacky in its 2026 Threat Detection Report as a widespread family of functional-looking AI-helper and utility applications with hidden remote-command capability. Related samples extend to December 2024, activity crossed industries during 2025, and Red Canary reported the family as its most prevalent named threat for three months before a December decline. Unit 42 independently placed it in a broader ecosystem of signed productivity-app clusters while cautioning that certificate, code, and infrastructure differences do not prove a single operator.

How it works: a user launches a signed lure such as GoAskBobby, CheckWithGilbert, AskBettyHow, JustAskJacky, or ManualReaderPro. The installer places a Node.js runtime and GUID-named JavaScript below a lure-named AppData Local Programs directory, then imports task.xml to create a GUID-named scheduled task that relaunches node.exe with the script. The JavaScript reads MachineGuid and operating-system details, heartbeats to dynamic-looking API domains, decodes Base64 and single-byte-XOR tasking, and can evaluate received JavaScript in memory. Red Canary saw reconnaissance but did not observe a later payload objective, so this pack does not invent one.

Why detection belongs on behavior: valid signing is not a trust verdict, lure names can change, and the five published API domains are historical infrastructure. The durable intersection is unusual Node.js execution from an AppData application directory, XML task creation that points back to that runtime, and discovery children parented by node.exe. Four CQL queries cover those process and DNS pivots. Non-PE JavaScript writes, certificate subject/serial, decoded in-memory evaluation, proxy content, IPv6, and deeper wrapper lineage remain explicit gaps until the target tenant supplies evidenced fields.

Operational consequence: remote JavaScript tasking under a user context creates a flexible foothold even when no second-stage payload is visible. Analysts should preserve task XML, installed files, hashes, signer context, process lineage, DNS, and user/session evidence before disabling persistence. Application control should begin in audit mode because legitimate Node/Electron software and enterprise installers can resemble parts of this chain.

Only sanitized plain-text evidence from the current run is retained. Source pages were treated as untrusted data; no embedded instructions, commands, scripts, credentials, or active content were used.

Claim ledger

The chain is evidence-led: product or lure execution, placement and persistence, command behavior, and remote communications are kept separate so an analyst can stop at the strongest corroborated step.

Hypotheses

Affected surface and telemetry

Coverage assumes managed Windows endpoints with ProcessRollup2, ScheduledTaskRegistered, and DnsRequest where populated, plus native task, browser, DNS, proxy, and application-control records. Direct-parent depth, non-PE file writes, signer certificate identity, HTTP content, IPv6, and tenant field population require environment-specific confirmation.

Indicators below are source-bound historical hunt pivots, not proof of compromise or timeless block entries. Require behavior, host, user, process, and timing context; assign review/expiry dates to infrastructure.

ATT&CK rows describe attacker behavior supported by named claims. Every mapping is explicitly an analyst inference; neither product inventory nor hardening is mislabeled as adversary behavior.

These native pivots supply evidence that portable endpoint CQL cannot safely invent. Complete them alongside the query set and preserve original records before remediation.

All queries are static-only. Start with a one-hour manual window, confirm the repository, fields, and row semantics, then expand to the documented lookback.

// HUNT: AppData Node.js launching JavaScript
// HYPOTHESIS: H01
// USE: hunt
// MITRE: T1059.007
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — identify infrequent AppData runtime execution
// REQUIRES: #event_simpleName=ProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: legitimate Node or Electron applications
// TUNING: exclude developer workstations and approved product install paths
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /\\node\.exe$/i
| CommandLine = /\\appdata\\local\\programs\\/i
| CommandLine = /\.js(?:"|\s|$)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Task XML launching Node.js from AppData
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1053.005
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — scheduled-task persistence remains durable
// REQUIRES: #event_simpleName=ProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: software installers that import scheduled-task XML
// TUNING: exclude approved deployment tools and known task XML paths
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /\\schtasks\.exe$/i
| CommandLine = /\/create/i
| CommandLine = /\/xml/i
| CommandLine = /appdata\\local/i
| CommandLine = /node\.exe/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Historical JustAskJacky C2 DNS hits
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1071.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 90d — historical indicator sweep only
// REQUIRES: #event_simpleName=DnsRequest; DomainName, ContextBaseFileName, ContextProcessId_decimal
// FALSE POSITIVES: security research or sinkhole lookups
// VALIDATION: STATIC-ONLY
#event_simpleName = DnsRequest
| test(@timestamp >= now() - 7776000000)
| in(DomainName, values=["api.k2ioeasm874fnacr9x.com","api.j6vmldsufhwx8zn69z.com","api.vtqgo0729ilnmyxs9q.com","api.nk99s1s3zkutjlyodx.com","api.78kwijczjz0mcig0f0.com"])
| table([@timestamp, ComputerName, DomainName, ContextBaseFileName, ContextProcessId_decimal, aid])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: Node.js parented reconnaissance
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1082
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — correlate low-frequency discovery with runtime context
// REQUIRES: #event_simpleName=ProcessRollup2; ParentBaseFileName, ImageFileName, CommandLine
// FALSE POSITIVES: Node-based management and inventory tooling
// TUNING: exclude approved Node automation parents and managed inventory hosts
// VALIDATION: STATIC-ONLY
#event_simpleName = ProcessRollup2
| test(@timestamp >= now() - 2592000000)
| ParentBaseFileName = /^(node|justaskjacky|goaskbobby|checkwithgilbert|askbettyhow)\.exe$/i
| ImageFileName = /\\(reg|systeminfo|whoami|ipconfig|nltest|net)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc, limit=1000)

Stage 4 is deliberately degraded: every candidate remains hunt-only and design-only because no tenant parse, positive test, benign baseline, suppression, volume, routing, owner, or SLA evidence exists. No Custom IOA or scheduled alert is shipped.

Promotion gate

Confirm tenant parsing and populated fields; run safe positive and representative benign tests; measure prevalence and cost; define grouping, deduplication, suppressions, routing, owner, SLA, and rollback; then re-review independently.

CSV-style copy blocks retain source IDs and context. Historical infrastructure is supplied for retrospective hunting only; validate ownership and expiry before any prevention action.

type,value,action,severity,expiration,description,tags
path,GoAskBobby.exe,detect,medium,2027-09-04,AI-helper lure filename,source:S01
path,CheckWithGilbert.exe,detect,medium,2027-09-04,AI-helper lure filename,source:S01
path,JustAskJacky.exe,detect,medium,2027-09-04,AI-helper lure filename,source:S01
path,AskBettyHow.exe,detect,medium,2027-09-04,AI-helper lure filename,source:S01
path,manualreaderpro.exe,detect,medium,2027-09-04,manual-reader lure filename,source:S01
domain,api.k2ioeasm874fnacr9x.com,detect,medium,2026-12-04,historical C2 example,source:S01
domain,api.j6vmldsufhwx8zn69z.com,detect,medium,2026-12-04,historical C2 example,source:S01
domain,api.vtqgo0729ilnmyxs9q.com,detect,medium,2026-12-04,historical C2 example,source:S01
domain,api.nk99s1s3zkutjlyodx.com,detect,medium,2026-12-04,historical C2 example,source:S01
domain,api.78kwijczjz0mcig0f0.com,detect,medium,2026-12-04,historical C2 example,source:S01

GoAskBobby.exe,sources=S01,context=AI-helper lure filename,volatility=medium
CheckWithGilbert.exe,sources=S01,context=AI-helper lure filename,volatility=medium
JustAskJacky.exe,sources=S01,context=AI-helper lure filename,volatility=medium
AskBettyHow.exe,sources=S01,context=AI-helper lure filename,volatility=medium
manualreaderpro.exe,sources=S01,context=manual-reader lure filename,volatility=medium

api.k2ioeasm874fnacr9x.com,sources=S01,context=historical C2 example,volatility=high
api.j6vmldsufhwx8zn69z.com,sources=S01,context=historical C2 example,volatility=high
api.vtqgo0729ilnmyxs9q.com,sources=S01,context=historical C2 example,volatility=high
api.nk99s1s3zkutjlyodx.com,sources=S01,context=historical C2 example,volatility=high
api.78kwijczjz0mcig0f0.com,sources=S01,context=historical C2 example,volatility=high

Deployable playbook · CTRL01 + CTRL02

1. Confirm incident authority, owner, business dependencies, evidence storage, and recovery path.
2. Capture task definitions, process trees, files and hashes, DNS/network records, user/session state, and current policy before change.
3. Pilot the containment or domain/task change on one confirmed endpoint or small cohort.
4. Verify the expected malicious behavior stops and evidence remains accessible.
5. Run application, authentication, network, and user workflow health checks.
6. Expand only to confirmed matching systems after the pilot remains healthy.
7. If a stop condition occurs, apply the documented narrow rollback and verify restored service without reintroducing suspect artifacts.
8. Retain before/after exports, approvals, test evidence, and owner sign-off.

Deployable playbook · CTRL03 + CTRL05

1. Inventory approved applications, publishers, install paths, owners, and exception requirements.
2. Export current application-control policy and confirm a tested rollback channel.
3. Deploy the new policy to an isolated audit-only pilot.
4. Exercise approved applications and harmless representative tests; review every unexpected audit event.
5. Verify business workflows, software updates, and developer exceptions.
6. Promote narrowly only when audit data and owners support each allow/deny decision.
7. Rollback to the previous signed policy if a critical application fails and verify endpoint health.
8. Retain policy hashes, audit samples, approvals, exceptions, and review dates.

Continuity rule: preserve evidence first. Do not isolate critical systems, remove tasks/files, revoke credentials, or impose application-control enforcement without incident authority, the service owner, known dependencies, and a tested recovery path.

Validation state: STATIC REVIEW PASSED after local structure/safety, field/event, CQL syntax, and source-snapshot provenance gates. The offline dry run records extraction and profile readiness only; it does not contact Falcon or prove parsing, detection, canary success, or deployment.

Recorded gaps and next evidence

• Every query remains tenant-unverified and design-only.
• Direct-parent lineage, field population, IPv6, proxy content, and environment-specific exclusions require tenant review.
• Historical atomics require context and expiry; no query result was generated by this build.
• Next step: run the named DO FIRST query manually for one hour, confirm fields and semantics, then record positive and benign tests before promotion.