{
  "family": "nymeria",
  "sample_count": 102,
  "category": "downloader",
  "description": "Nymeria (cataloged across security vendors as TrojanDownloader:Win32/Nymeria, Trojan.Nymeria, and Backdoor:Win32/Nymeria) is a modular Windows trojan downloader and reconnaissance threat active since 2016. Often observed acting as a multi-stage loader or dropper in campaigns delivering commercial remote access tools (such as LodaRAT) and credential stealers, Nymeria infiltrates endpoints through malicious spearphishing email attachments, weaponized Office macro documents, and trojanized freeware downloads. Upon initial execution, Nymeria drops a copy of its executable stub into hidden user directories (such as %LocalAppData%\\Temp or %AppData%) and establishes persistence via Windows Registry Run keys and scheduled tasks. The malware deploys in-memory anti-debugging and virtual machine detection routines to verify that it is running in a live user environment rather than an analysis sandbox. Once cleared, Nymeria captures system reconnaissance data (hostname, user privilege level, OS architecture) and initiates encrypted HTTP/HTTPS beaconing to remote command-and-control servers to download, unpack, and launch secondary payloads including info-stealers, keyloggers, and banking trojans.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDownloader:Win32/Nymeria",
    "Trojan.Nymeria",
    "Win32/Nymeria",
    "Backdoor:Win32/Nymeria"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDownloader:Win32/Nymeria?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nymeria is a Windows trojan downloader that stages secondary malware such as keyloggers, remote access tools, and password stealers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nymeria infect user workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via spearphishing emails with weaponized attachments (Office documents, ZIP archives) and trojanized freeware installers."
      }
    },
    {
      "@type": "Question",
      "name": "Which secondary threats are commonly dropped by Nymeria?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is frequently observed staging Remote Access Trojans (like LodaRAT), infostealers, banking trojans, and credential harvesters."
      }
    },
    {
      "@type": "Question",
      "name": "How does Nymeria evade detection by security software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for hypervisor and sandbox artifacts, runs memory-resident unpacking routines, and executes from temporary user directories."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken following a Nymeria alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, review network proxy logs to block C2 servers, run offline antimalware remediation, and reset account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1105",
    "T1566.001",
    "T1055",
    "T1547.001",
    "T1027",
    "T1053.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint from internal networks to prevent secondary malware staging and credential exfiltration.",
    "Capture a volatile memory image to preserve injected downloader threads, active socket connections, and decrypted C2 domains.",
    "Inspect the Windows Task Scheduler and Registry Run keys to eliminate persistent autostart entries referencing %Temp% binaries.",
    "Audit all corporate user accounts authenticated on the endpoint and enforce immediate password resets."
  ],
  "what_to_avoid": [
    "Do not close the incident merely because the initial Nymeria file was quarantined; always verify if secondary payloads executed.",
    "Avoid allowing non-whitelisted executable binaries to run directly from the Windows %Temp% and %AppData% directories."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Commercial Enterprises",
    "Healthcare and Public Sector"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Commodity Malware Operators"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "lineage": {
    "derived_from": [
      "Modular Windows Downloader Trojans"
    ],
    "variants": [
      "Nymeria.A",
      "Nymeria Loader v2"
    ]
  },
  "iocs": {
    "file_hashes": [
      "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b",
      "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c"
    ],
    "delivery": [
      "Malicious email attachments disguised as invoices or receipts",
      "Deceptive software downloads from third-party distribution portals"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NymeriaUpdate",
      "Scheduled Task executing dropped loader from %LocalAppData%\\Temp"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDownloader:Win32/Nymeria",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Nymeria"
    },
    {
      "name": "PCRisk Threat Research - Trojan.Nymeria Analysis",
      "url": "https://www.pcrisk.com/removal-guides/trojan-nymeria"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}