{
  "family": "netstream",
  "sample_count": 18,
  "category": "backdoor",
  "description": "NetStream (tracked across security telemetry as Backdoor:Win32/NetStream, Trojan:Win32/NetStream, and Backdoor.NetStream) is a stealthy Windows remote access trojan and network proxy agent. Delivered through phishing emails and malicious network scanning exploitation, NetStream installs a background communication agent capable of opening covert listening ports or establishing outbound reverse TCP/TLS sessions to attacker command-and-control servers. NetStream enables remote operators to execute arbitrary command-line instructions via cmd.exe, spawn interactive shells, capture desktop screenshots, and pivot internal network traffic through the compromised host as a network proxy relay.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/NetStream",
    "Trojan:Win32/NetStream",
    "Win32/NetStream",
    "Backdoor.NetStream",
    "NetStream RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/NetStream?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetStream is a Windows remote access trojan that establishes reverse shells and acts as a network proxy relay."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious actions can attackers execute via NetStream?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can run arbitrary shell commands, capture desktop screenshots, exfiltrate data, and relay network traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does NetStream infect Windows endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects systems via spear-phishing emails with malicious loaders, exploit payloads, and drive-by downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does NetStream maintain persistence on an infected machine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows services and writes autostart entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended containment steps for NetStream?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the infected endpoint from the network, capture memory artifacts, terminate the rogue process, and block external C2 IPs."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1090",
    "T1547.001",
    "T1082",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-phishing Emails with Weaponized Loaders",
    "Malicious Software Downloads",
    "Network Service Exploitation"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Interactive Remote Shell Execution (cmd.exe)",
    "Network Traffic Proxy & SOCKS Relaying",
    "Desktop Screenshot Capture",
    "Autostart Registry Run Key Persistence",
    "Encrypted Command & Control Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound reverse TCP/TLS sessions connecting to external C2 IP addresses on non-standard ports",
      "Encrypted network beacon packets transmitting machine hostname and OS build details"
    ],
    "evasion_techniques": [
      "Masquerading under legitimate process names like svchost.exe or taskhostw.exe",
      "Dynamic API resolution to conceal socket and process spawning APIs"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7a808192a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
      "8b9192a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NetStreamAgent"
    ],
    "file_paths": [
      "%AppData%\\NetStream\\netstream.exe",
      "%LocalAppData%\\Temp\\proxy.dll"
    ]
  },
  "defensive_measures": [
    "Monitor network firewalls for unauthorized outbound connections over non-standard high ports",
    "Implement endpoint application whitelisting and restrict software execution from user AppData directories",
    "Deploy endpoint detection and response (EDR) rules detecting unusual cmd.exe spawned by background network processes"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/NetStream",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/NetStream"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.NetStream",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/NetStream.A",
      "Backdoor:Win32/NetStream.B"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Remote Access & Network Pivoting",
  "sample_hashes": []
}