{
  "family": "stream_rat",
  "sample_count": 0,
  "category": "trojan",
  "description": "Stream-RAT (also styled across security documentation as StreamRAT, Backdoor.StreamRAT, and Trojan.StreamRAT) is an early-to-mid 2000s Remote Access Trojan engineered primarily in Visual Basic to provide real-time multimedia surveillance and remote endpoint control. Distinguishing itself from conventional command-line backdoors of the era, Stream-RAT was specifically developed to provide low-latency desktop screen streaming, webcam hijacking, and microphone eavesdropping over raw TCP connections. Upon infecting a Windows host, Stream-RAT establishes persistence via registry autostart keys, hides its executable inside system directories, and establishes a persistent listening server socket or reverse connection to an operator-controlled management console. Beyond surveillance, Stream-RAT provides full remote administration capabilities including file upload/download, process control, keyboard monitoring, and remote registry editing.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "StreamRAT",
    "Backdoor.StreamRAT",
    "Trojan.StreamRAT",
    "Backdoor:Win32/StreamRAT",
    "Stream RAT 1.0"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Stream-RAT malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stream-RAT is an early Visual Basic remote access trojan specializing in real-time video streaming, webcam surveillance, and remote administration."
      }
    },
    {
      "@type": "Question",
      "name": "What unique surveillance features did Stream-RAT offer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It featured low-latency desktop video feed streaming, live webcam video capture, and real-time microphone audio eavesdropping."
      }
    },
    {
      "@type": "Question",
      "name": "How does Stream-RAT communicate with attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The trojan communicates with an operator client over direct TCP sockets, sending compressed image frames and receiving remote commands."
      }
    },
    {
      "@type": "Question",
      "name": "How does Stream-RAT establish persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies its server executable to the Windows system folder and creates autostart entries in the registry Run key."
      }
    },
    {
      "@type": "Question",
      "name": "How can Stream-RAT be removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate the active Visual Basic process, delete startup registry entries, and remove the binary from the system directory."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2004,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Visual Basic RAT Frameworks"
    ],
    "variants": [
      "StreamRAT 1.0",
      "StreamRAT 2.0",
      "StreamRAT.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1113",
    "T1125",
    "T1123",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Disconnect the affected workstation from the local network and internet to disable video/audio streaming sessions.",
    "Identify and terminate the running Stream-RAT server process.",
    "Remove autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the trojan executable from Windows system directories."
  ],
  "what_to_avoid": [
    "Do not execute unknown media player utilities or video codecs obtained from unverified download sources.",
    "Avoid leaving webcams or audio devices connected to unsecured workstations."
  ],
  "iocs": {
    "file_hashes": [
      "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f",
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c"
    ],
    "delivery": [
      "Distribution via underground hacker forums and file-sharing networks disguised as multimedia tools",
      "Phishing emails with compressed attachments containing Visual Basic droppers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StreamRATServer",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StreamService"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence Portal - Backdoor.Win32.StreamRAT",
      "url": "https://threats.kaspersky.com"
    },
    {
      "name": "Malware Museum Historical RAT Collection - StreamRAT",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}