How to detect Meterpreter and similar malware?

Question

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?

Most common anti-rootkit software like rkhunter and chkrootkit don't find it.

Answer 1

First of all 'meterpreter' is not malware. I gather you mean how to detectet open meterpreter sessions between a compromised machine and the attacker.

Most antivirus can detect meterpreter payloads in memory - they are public, and thats why metasploit has special polymorphic engines to try to hide the payloads. A nice factoid: Commercial tools like canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads.

Also, you can detect things on the network level if the session is not encrypted (defaults to ssl nowadays): most IDS can detect meterpreter, Snort has signatures for example. You can also detect the initial meterpreter dll upload.

Also, tools exist for the job: Antimeter - http://packetstormsecurity.org/Win/antimeter.zip - it can detect processes that have the malicious dll injected and kill them.

On the host, netstat and process explorer will show funny connections and dlls loaded.

Finally, it isn't true that nothing ever touches the disk: The script first uploads the malicious dll on disk and then injects it into a process.

Answer 2

Avast! with full heuristics can find Meterpreter, as can many other AV solutions.

However, if the shellcode launcher in the Metasploit Framework is modified with shellcodeexec, then standard AV will no longer be able to detect Meterpreter.

You would need to go through every process on the system and look for suspicious entry points (unlikely) or suspicious IATs (Meterpreter uses VirtualAllocEx, CreateProcessA, WriteProcessMemory, CreateRemoteThread, ReadProcessMemory, OpenProcess, CreateServiceA, StartServiceA, and OpenProcessToken by default).

Answer 3

Generally that sort of thing won't be found by a rootkit detector as it is only in RAM and rootkit detectors look for the obvious persistent elements a rootkit needs.

If this malware is RAM only then it can have the same ability to cause damage as other malware which resides in RAM. As @nealmcb pointed out, unless it can write to persistent storage, then a reboot will fix the issue entirely so generally it will not be much of a worry - it certainly won't be considered a rootkit.

However, as far as detecting a reboot, writing to disk and then moving back out to RAM and covering tracks goes - I wonder if Meterpreter based malware can do that. Theoretically it looks possible.

(feel free to flag your question for migration to security.stackexchange.com for a wider panel of answers)