GoAskBobby.exe Malware Analysis: Technical Breakdown of a Stealthy Stealer

Background

JustAskJacky is a family of malicious Node.js applications that masquerade as helpful AI chatbots or utilities. It is a genuine trojan horse: the downloaded tool actually works, so nothing looks wrong to the user, while hidden code performs reconnaissance and executes attacker commands. Red Canary ranks it the #2 threat of 2026 (affecting roughly 7.4% of its monitored customers); it surfaced mid-2025 with related samples going back to December 2024. GoAskBobby.exe is one of the ‘AI helper’ lures (alongside Jacky, Betty and Gilbert), part of 12+ tracked filenames that also include fake manual-reader and utility themes. It spreads opportunistically via SEO and malvertising.

This matters for triage: the source analysis of this exact sample returned verdict UNKNOWN, risk 35/100, and 0 IOCs / 0 ATT&CK techniques / 0 signatures. That is not evidence of safety. It is what a signed InnoSetup installer bundling a ~20 MB Node.js app looks like to static analysis. Public threat intelligence identifies the hash as the GoAskBobby / JustAskJacky lure, which is exactly why a static verdict alone should never close the case on a large signed installer.

What we observed

Regardless of the lure name, JustAskJacky behaves the same way:

• A real tool with a hidden passenger: the signed installer delivers a functioning AI chatbot, so the user interacts with it normally, while it also drops Node.js malware capable of remote command execution.
• The tell-tale execution: node.exe runs a JavaScript file with a GUID-like name from an unusual folder under AppData\Local\Programs\<lure-name> (for example, …\GoAskBobby\24c92c24-…js), Node executing a GUID-named script from a user profile is the strongest single indicator.
• Persistence via scheduled task: the installer imports a task XML from a Temp\is-*.tmp folder to schedule node.exe plus the GUID JavaScript, using that same GUID as the task name (cmd.exe /C schtasks /Create /tn “<guid>” /xml …).
• Recon and fileless C2: node.exe reads the machine’s MachineGUID and OS version and beacons to command-and-control that looks algorithmically generated, api.<~18 random alphanumerics>.com over dynamic DNS. The JavaScript (obfuscated with Obfuscator.io) receives Base64- and XOR-encoded JavaScript on each heartbeat and runs it via eval(), so the follow-on code never touches disk.
• Signed to look legitimate: the installers carry EV code-signing certificates issued to shell-company LLCs; several were revoked after distribution, proof that a valid signature is not proof of safety. Observed follow-on so far is mostly reconnaissance, likely to select victims for later stages.

JustAskJacky (GoAskBobby) execution chain

The installer is signed and the AI tool really works, so static verdicts miss it. The signal is behavioural: node.exe, a GUID .js, a scheduled task, and DGA-like C2.

Attribution

This is opportunistic, financially motivated cybercrime, not a named nation-state actor, a ‘threat of opportunity’ pushed through SEO poisoning and malvertising against whoever downloads a free ‘AI helper’ or utility. It is distinct from the superficially similar Node.js threat Tampered Chef (no shared JavaScript or code signers). Confidence in the family identification is high (multi-vendor, high-prevalence reporting); the specific sample is tied to the GoAskBobby lure via public intelligence, and the ATT&CK mapping below is analyst-derived because the automated engine returned none.

Confidence: 88%.

It answers your questions and does your attacker’s reconnaissance in the same breath, a working AI chatbot with node.exe quietly phoning home.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Hunt for JustAskJacky / GoAskBobby behaviour (static verdicts miss the signed installer)
# 1) Scheduled-task creation from AppData\Local (Red Canary detection pattern)
index=edr process_name="cmd.exe" command_line="*schtasks*" command_line="*/create*" command_line="*appdata\\local*" command_line="*/xml*"
# 2) node.exe executing a GUID-named .js from a user profile Programs folder
index=edr process_name="node.exe" (command_line="*\\AppData\\Local\\Programs\\*" command_line="*.js*") AND command_line="*-*-*-*-*.js*"
# 3) DGA-like C2 pattern: api.<~18 random alphanumerics>.com
index=dns OR index=proxy (domain IN ("api.cjby76nlcynrc4jvrb.com","api.k2ioeasm874fnacr9x.com","api.j6vmldsufhwx8zn69z.com","api.vtqgo0729ilnmyxs9q.com","api.nk99s1s3zkutjlyodx.com","api.78kwijczjz0mcig0f0.com")) OR domain="api.*"
# 4) Installer-signer hygiene: revoked EV certs seen signing JustAskJacky (Sectigo Public Code Signing CA EV R36)
#    Thumbprints: 3ebbb02a48f7db26b708f5e535e8dce8eff2caea (App Interplace LLC),
#    2d4129109dbf921db0bc48d41da32da0ff1bf024 (Pixel Catalyst Media LLC),
#    5b036dad04db22e8560716deabc59a5e524b6be2 (Method Marketing Media LLC),
#    2b0a08ccefd7355207780ee21e69b8a7fa3c0750 (Fusion Core Reach LLC),
#    2df81ab14a5794f22722983ab3d8e8d7d643908b (DataX Engine LLC)
#
# Note: a 'signed' + 'working AI tool' + UNKNOWN static verdict is the profile -- pivot on behaviour, not reputation.

Recommendations

• Detect on behaviour, not reputation: hunt for node.exe running a GUID-named .js from AppData\Local\Programs and for cmd.exe/schtasks creating a scheduled task from an AppData path. These fire even though the installer is signed and the AI tool works.
• Block the C2 and the pattern: block the listed api.<random>.com domains and monitor for the DGA-like ‘api.’ + ~18-random-character ‘.com’ beaconing over dynamic DNS.
• Do not trust the signature: JustAskJacky installers use EV certificates from shell-company LLCs, several since revoked, verify signer reputation and certificate age, and enforce your revocation checking.
• Reduce the attack surface: restrict application installs and downloads, provide users with known-safe software for their role, and warn staff that ‘free AI helper’, PDF/manual-reader and utility downloads are a common lure right now.
• Assume reconnaissance happened: if a JustAskJacky lure ran, treat the host as profiled (MachineGUID/OS collected) and hunt for follow-on activity, since the operators use recon to select victims for later stages, do not close the case on the ‘UNKNOWN’ static verdict.