Threat Database Trojans Trojan.PWS.Onlinegames.AW

Trojan.PWS.Onlinegames.AW

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 1
First Seen: March 24, 2026
Last Seen: October 18, 2026
OS(es) Affected: Windows

Trojan.PWS.Onlinegames.AW is a password-stealing Trojan that targets Windows computers. It belongs to a well-known family of malware designed to silently harvest login credentials, particularly from online games and related services, and send them to remote attackers. With a danger level rated 8 out of 10, this threat is considered highly dangerous and capable of causing serious harm to both personal data and system security.

What Trojan.PWS.Onlinegames.AW Does

Once active on a system, Trojan.PWS.Onlinegames.AW runs quietly in the background without displaying any visible signs to the user. It is built as a DLL component for 32-bit Windows systems and is typically executed using legitimate Windows tools such as rundll32.exe, a technique that helps it blend in with normal system activity and avoid raising suspicion. This method of execution, where the malicious DLL is launched through a trusted system process, is a common evasion tactic used to bypass basic security checks.

The Trojan is capable of monitoring system activity, manipulating running processes, and employing anti-debugging techniques to resist analysis and removal. Its core purpose is credential theft: it is designed to capture usernames, passwords, and other sensitive information, which can then be transmitted to cybercriminals. In many cases, threats in this family can also give attackers broader control over the infected machine, potentially allowing them to install additional malware, modify system settings, or delete files.

How It Usually Gets Onto Computers

Trojan.PWS.Onlinegames.AW typically spreads through deceptive means rather than by exploiting a single specific flaw. Common infection methods for this type of threat include downloading software from untrustworthy or malicious websites, opening email attachments from unknown or unverified senders, and exploiting unpatched security vulnerabilities in the operating system or installed applications. Infected files may be disguised with misleading extensions, such as .exe, .pif, .avi, or even .jpg, tricking users into thinking they are opening something harmless.

Risks for the User

The presence of this Trojan on a system poses significant risks. Because it is designed to steal login credentials, victims may suffer unauthorized access to their online accounts, including gaming, email, or financial services. Beyond credential theft, this type of malware can allow attackers to gain extensive control over the infected machine, potentially leading to further malware installations, data loss, or system instability. The malware's lack of a digital signature and its use of stealth techniques make it harder for average users to detect through casual observation.

Signs of Infection

Because threats like this are designed to operate covertly, visible symptoms may be minimal or absent. However, users should be alert to unusual system behavior, such as unexpected slowdowns, unfamiliar processes running in the background, unauthorized changes to files or settings, or suspicious network activity. Unexplained login attempts or password changes on online accounts can also be a warning sign that credentials have been compromised.

How to Stay Protected

To reduce the risk of infection, users should avoid downloading software from unverified or suspicious websites and refrain from opening email attachments from unknown senders. Keeping the operating system and all installed applications updated with the latest security patches helps close vulnerabilities that malware often exploits. Using reputable security software, maintaining regular backups of important data, and practicing caution when browsing or installing new programs are essential habits for staying protected against threats like Trojan.PWS.Onlinegames.AW.

Analysis Report

General information

Family Name: Trojan.PWS.Onlinegames.AW
Signature status: No Signature

Known Samples

MD5: a29fdca7c2f3e1b6583ba8a636e645ab
SHA1: 33056e678f76ac1cd5a16fee4e40cb4b5d80b299
SHA256: DADC22287555C31F7994263D143D6AB4B52B37CD82ECC56EEEAD7D7B519F2E93
File Size: 4.61 KB, 4608 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have resources
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • x86

Block Information

Total Blocks: 15
Potentially Malicious Blocks: 3
Whitelisted Blocks: 0
Unknown Blocks: 12

Visual Map

x x ? x ? ? ? ? ? ? ? ? ? ? ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\33056e678f76ac1cd5a16fee4e40cb4b5d80b299_0000004608.,LiQMAxHB