Malleable encryption What I would like to achieve is the following:

Alice sends to Bob the encryption of a datagram that has the following format:

| 256-bit number | SomeLongArrayOfZeroes |


Bob knows the decryption key.

But before the datagram reaches Bob, there are some intermediaries which I would like to be able to add some additional 256-bit numbers. These third parties should not be able to read the first 256-bit number which was included by Alice. Let's also assume that these third parties know which portions of the ciphertext they have to modify in order to not modify data inserted by other parties.

I was researching homomorphic encryption but it looks like an overkill for this purpose. There's no need for two ciphertexts to interact with each other. I just need to be able to add additional data to already encrypted ciphertext which already contains some information without imposing damage to it. Assuming the other parties will follow some rules so as not to damage the prefix. A third party should not be able to decrypt information added by the other third party.

In the end, Bob should be able to decrypt the message using the key provided by Alice.

Any suggestions? I was thinking about some kind of a stream cipher. What are the possible solutions?
Several cryptosystems possess this partially homomorphic property. Notable examples include Benaloh, and Naccache-Stern which generalizes it, as well as Damgård–Jurik which generalizes the Paillier cryptosystem. 

A worked example of the latter scheme:

The encryption primitive is defined as $E(m)=g^m\cdot r^n \mod n^2$ for a random element $r \in \mathbb{Z}$. From this we can see that given two ciphertexts we have:
$$E(m_0)\cdot E(m_1) = (g^{m_0}\cdot {r_0}^n) \cdot (g^{m_1}\cdot {r_1}^n) \mod n^2$$
$$E(m_0)\cdot E(m_1) = g^{m_0 + m_1}\cdot {(r_0 \cdot r_1)}^n \mod n^2$$
$$E(m_0)\cdot E(m_1) = E(m_0 + m_1) \mod n^2$$

So we can compute the encryption of the addition of two plaintexts from only the ciphertexts, without revealing them, by simply multiplying the ciphertexts.

Additionally, if we know the value of $m_1$ then we can avoid using the encryption primitive and directly compute as follows:
$$E(m_0)\cdot g^{m_1} = (g^{m_0}\cdot {r_0}^n) \cdot g^{m_1} \mod n^2$$
$$E(m_0)\cdot g^{m_1} = g^{m_0 + m_1}\cdot {r_0}^n \mod n^2$$
$$E(m_0)\cdot g^{m_1} = E(m_0 + m_1) \mod n^2$$

Now, by viewing multiplication as repeated addition, we can extend the homomorphic property to multiply by a constant, by implementing repeated ciphertext multiplication using exponentiation:
$$E(m_0)^{m_1} = (g^{m_0}\cdot {r_0}^n)^{m_1} \mod n^2$$
$$E(m_0)^{m_1} = g^{m_0 \cdot m_1}\cdot {({r_0}^{m_1})}^n \mod n^2$$
$$E(m_0)^{m_1} = E(m_0 \cdot m_1) \mod n^2$$

EDIT: Thanks tylo for specific examples