Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 03:22:19 UTC
Home > List all groups > List all tools > List all groups using tool StreamEx
 Tool: StreamEx
Names StreamEx
Category Malware
Type Reconnaissance, Backdoor
Description
(Cylance) Cylance dubbed this family of malware StreamEx, based upon a common
exported function used across all samples ‘stream’, combined with the dropper
functionality to append ‘ex’ to the DLL file name.
The StreamEx family has the ability to access and modify the user’s file system, modify
the registry, create system services, enumerate process and system information,
enumerate network resources and drive types, scan for security tools such as firewall
products and antivirus products, change browser security settings, and remotely execute
commands. The malware documented in this post was predominantly 64-bit, however,
there are 32-bit versions of the malware in the wild.
Information
MITRE ATT&CK AlienVault OTX Last change to this tool card: 22 April 2020
Download this tool card in JSON format
All groups using tool StreamEx
Changed Name Country Observed
APT groups
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fa1c38a2-c132-470d-8a83-b5b6df3e2a00
Page 1 of 2

Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu
Kittens
2010-Oct 2018
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fa1c38a2-c132-470d-8a83-b5b6df3e2a00
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fa1c38a2-c132-470d-8a83-b5b6df3e2a00
Page 2 of 2