Rabby exe Trojan Agent File Malware Analysis: 842876f5b77a2517b2f344af9c3c923d
Gridinsoft Logo
File Icon

Rabby.exe Trojan Agent Analysis

Updated 2 days ago
Checked by Malware Check
rabby.exe

Technical Analysis

File Name rabby.exe
File Type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version 1.0.229.174
Database Version 2025-11-27 12:00:28 UTC
⚠

Trojan.Win32.Agent.oa!s1

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
4,398,512
File Size (bytes)
2025-11-27
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
842876f5b77a2517b2f344af9c3c923d
SHA1
320d5a2eaa89e581f897dfa1010e2b2748327705
SHA256
ee183109a692375f3d7caf2f6a1160d29c8fcf5660ca139f246c9534e1709ddc
SHA512
09cf28f88f2ddb1fe5c2cce280ab627e14b0791add8a3853f0fb5743df30c01f9bd9fef63368efe12e98c87f3e9d68db9b28c2d13e09c4fe332613da6942e3c2
ImpHash
9cbefe68f395e67356e2a5d8d1b285c0

PE Analysis

Basic Information

▼
Icon
Hash: 6b8676cabd53ca6d41e1c2f5f33906f6
Fuzzy: 36a305257d95530aca77005535c2cf67
dHash: e4922955552992e4
Image Base 0x00400000
Entry Point 0x00460300
Compilation Time 1970-01-01 00:00:00
Checksum 0x0043d21e (Actual: 0x0043d21e)
OS Version 6.1
PEiD Signatures PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Digital Signature OK
Imports 1 libraries
kernel32
Exports 0 functions
Resources 21 Resources
Sections 7 Sections

Version Information

▼
Comments FleetDeck Agent
CompanyName FleetDeck Inc.
FileDescription FleetDeck Agent
InternalName fleetdeck_installer
LegalCopyright © FleetDeck. All rights reservered
OriginalFilename fleetdeck_installer
ProductName FleetDeck Agent
Translation 0x0000 0x0000

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 874,096 bytes 874,496 bytes 6.13 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ BE29FFBBAEDDBA5B3AA8CF16E44FDC7A
.rdata 0x000d7000 856,308 bytes 856,576 bytes 5.64 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 38ADD4F885B7EB21B1713FBCC48D99CA
.data 0x001a9000 2,708,104 bytes 2,540,032 bytes 7.90 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE CEADA33740F0E08C9B03403EBA933B84
.idata 0x0043f000 988 bytes 1,024 bytes 4.62 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE ACADCE4CEB74094C5C5D6BACCE947CAC
.reloc 0x00440000 41,086 bytes 41,472 bytes 6.68 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6D743DCD4BEBF93BAC1530934BA76633
.symtab 0x0044b000 4 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 07B5472D347D42780469FB2654B7FC54
.rsrc 0x0044c000 70,824 bytes 71,168 bytes 7.87 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F67EA42B14E4399E8A019F8657C8779A
Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 21 (69,640 bytes)
Resource Type Count Total Size Percentage
RT_ICON 18 68,139 bytes
97.8%
RT_GROUP_ICON 1 258 bytes
0.4%
RT_VERSION 1 736 bytes
1.1%
RT_MANIFEST 1 507 bytes
0.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

OK

Trojan.Win32.Agent.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.oa!s1 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware