Detect Nimplant Pe

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•6

This YARA rule detects the Nimplant malware, a lightweight C2 framework. It identifies Nimplant by looking for specific DLL and library names (some with common typos), a comprehensive list of Nim-related source file names often found in Nimplant builds, specific hexadecimal patterns corresponding to Windows API calls (like GetComputerNameW, CreateProcess, GetUserNameW, OpenProcessToken, CreateFileA, VirtualProtect, CreateToolhelp32, WinHttpConnect), Zlib compression patterns, TLS callback patterns, and various strings including registry keys and a version string for Nimplant itself. The rule aims to identify Nimplant executables or related artifacts on Windows systems.