Trojan.PWS.Onlinegames.AW
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 1 |
| First Seen: | March 24, 2026 |
| Last Seen: | October 18, 2026 |
| OS(es) Affected: | Windows |
Trojan.PWS.Onlinegames.AW is a password-stealing Trojan that targets Windows computers. It belongs to a well-known family of malware designed to silently harvest login credentials, particularly from online games and related services, and send them to remote attackers. With a danger level rated 8 out of 10, this threat is considered highly dangerous and capable of causing serious harm to both personal data and system security.
Table of Contents
What Trojan.PWS.Onlinegames.AW Does
Once active on a system, Trojan.PWS.Onlinegames.AW runs quietly in the background without displaying any visible signs to the user. It is built as a DLL component for 32-bit Windows systems and is typically executed using legitimate Windows tools such as rundll32.exe, a technique that helps it blend in with normal system activity and avoid raising suspicion. This method of execution, where the malicious DLL is launched through a trusted system process, is a common evasion tactic used to bypass basic security checks.
The Trojan is capable of monitoring system activity, manipulating running processes, and employing anti-debugging techniques to resist analysis and removal. Its core purpose is credential theft: it is designed to capture usernames, passwords, and other sensitive information, which can then be transmitted to cybercriminals. In many cases, threats in this family can also give attackers broader control over the infected machine, potentially allowing them to install additional malware, modify system settings, or delete files.
How It Usually Gets Onto Computers
Trojan.PWS.Onlinegames.AW typically spreads through deceptive means rather than by exploiting a single specific flaw. Common infection methods for this type of threat include downloading software from untrustworthy or malicious websites, opening email attachments from unknown or unverified senders, and exploiting unpatched security vulnerabilities in the operating system or installed applications. Infected files may be disguised with misleading extensions, such as .exe, .pif, .avi, or even .jpg, tricking users into thinking they are opening something harmless.
Risks for the User
The presence of this Trojan on a system poses significant risks. Because it is designed to steal login credentials, victims may suffer unauthorized access to their online accounts, including gaming, email, or financial services. Beyond credential theft, this type of malware can allow attackers to gain extensive control over the infected machine, potentially leading to further malware installations, data loss, or system instability. The malware's lack of a digital signature and its use of stealth techniques make it harder for average users to detect through casual observation.
Signs of Infection
Because threats like this are designed to operate covertly, visible symptoms may be minimal or absent. However, users should be alert to unusual system behavior, such as unexpected slowdowns, unfamiliar processes running in the background, unauthorized changes to files or settings, or suspicious network activity. Unexplained login attempts or password changes on online accounts can also be a warning sign that credentials have been compromised.
How to Stay Protected
To reduce the risk of infection, users should avoid downloading software from unverified or suspicious websites and refrain from opening email attachments from unknown senders. Keeping the operating system and all installed applications updated with the latest security patches helps close vulnerabilities that malware often exploits. Using reputable security software, maintaining regular backups of important data, and practicing caution when browsing or installing new programs are essential habits for staying protected against threats like Trojan.PWS.Onlinegames.AW.
Analysis Report
General information
| Family Name: | Trojan.PWS.Onlinegames.AW |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
a29fdca7c2f3e1b6583ba8a636e645ab
SHA1:
33056e678f76ac1cd5a16fee4e40cb4b5d80b299
SHA256:
DADC22287555C31F7994263D143D6AB4B52B37CD82ECC56EEEAD7D7B519F2E93
File Size:
4.61 KB, 4608 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 15 |
|---|---|
| Potentially Malicious Blocks: | 3 |
| Whitelisted Blocks: | 0 |
| Unknown Blocks: | 12 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\33056e678f76ac1cd5a16fee4e40cb4b5d80b299_0000004608.,LiQMAxHB
|