Abdul Saboor, from Parwan province, was “the main suspect” and had fled the ministry following Saturday’s attack, officials told the BBC.
Nato withdrew all its personnel from Afghan ministries after the shooting.
The attack came on the fifth day of deadly protests over the burning of copies of the Koran by US soldiers.
At a news conference in Kabul on Sunday, Afghan President Hamid Karzai condemned the killings of the two US officers but said it was still not clear who was responsible.
The identities of the dead Nato officers have not been confirmed, but they are believed to have been an American colonel and major.
Reports said the gunman opened fire in a secure room in the ministry – one of the highest security buildings in the capital – at close range.
Nato spokesman Brig Gen Carsten Jacobsen said it was “concerning” that no clear picture had emerged of what happened.
Mr Saboor, 25, had served in several Afghan ministries and had worked at the interior ministry for some time, officials said.
He was responsible for security arrangements and had access to secure radio communication channels used by the ministries.
His family home in the Salang valley area of Parwan province, north-east Afghanistan, was raided overnight and his relatives in Kabul detained, they said.
There have been angry protests across the country over the Koran desecration
One senior Afghan general told the BBC: ”The virus of infiltration has spread like a cancer and it needs an operation. Curing it has not helped.”
Mr Karzai has appealed for calm.