nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and self-injects. Use this when you already have a file drop primitive and want a small, simple binary. Key and IV are optional. If omitted, the file is treated as raw unencrypted shellcode. stageless Downloads the encrypted blob from your C2 over HTTP using the Windows WinHTTP stack, decrypts it in memory, and self-injects. No file ever touches disk. Use this when you can execute a binary on the target but cannot reliably drop a second file. Edit the constants at the top of stageless/loader.nim before compiling: Techniques Sandbox evasion The stageless loader calls Sleep(5000) on startup and measures actual elapsed time with GetTickCount64. If less than 4500ms passed, the process exits. Most automated sandbox environments fast-forward or skip sleeps, causing the check to fail. This runs before any network activity or shellcode execution so sandboxes that inspect network behaviour see nothing.