Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to find Meterpreter or similar malware which doesn't modify the hard disk but is only stored in RAM?

Most common anti-rootkit software like rkhunter and chkrootkit don't find it.

share|improve this question

migrated from May 21 '11 at 11:22

This question came from our site for computer enthusiasts and power users.

But is meterpreter a rootkit in the first place? Isn't it just ordinary malware? – CodeInChaos May 21 '11 at 9:19
Migrating at request of OP. – DMA57361 May 21 '11 at 11:21

First of all 'meterpreter' is not malware. I gather you mean how to detect open Meterpreter sessions between a compromised machine and the attacker.

Most antivirus can detect meterpreter payloads in memory - they are public, and that's why Metasploit has special polymorphic engines to try to hide the payloads.

A nice factoid: Commercial tools like Canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads.

Also, you can detect things on the network level if the session is not encrypted (defaults to SSL nowadays): most IDS can detect meterpreter, Snort has signatures for example. You can also detect the initial meterpreter DLL upload.

Also, tools exist for the job: Antimeter - - it can detect processes that have the malicious DLL injected and kill them.

On the host, netstat and Process Explorer will show funny connections and DLLs loaded.

Finally, it isn't true that nothing ever touches the disk: The script first uploads the malicious DLL on disk and then injects it into a process.

share|improve this answer
"A nice factoid: Commercial tools like canvas exploitation framework make special agreements with antivirus companies to have them not detect their payloads." Is it public knowledge or some private info? – Nam Nguyen May 21 '11 at 13:20
I heard it from a very experienced pentester, on stage, during a talk in a recent conference.. So I guess it's semi-public. – john May 21 '11 at 13:26
+1 for process explorer. – user2213 May 21 '11 at 17:44
The malicious dll is most likely uploaded from a remote harddisk directly into the vulnerable process RAM. – rjt Jul 31 '14 at 12:57

Avast! with full heuristics can find Meterpreter, as can many other AV solutions.

However, if the shellcode launcher in the Metasploit Framework is modified with shellcodeexec, then standard AV will no longer be able to detect Meterpreter.

You would need to go through every process on the system and look for suspicious entry points (unlikely) or suspicious IATs (Meterpreter uses VirtualAllocEx, CreateProcessA, WriteProcessMemory, CreateRemoteThread, ReadProcessMemory, OpenProcess, CreateServiceA, StartServiceA, and OpenProcessToken by default).

share|improve this answer
From 2013-2014, the Veil Framework was a popular way to layer Meterpreter with additional self-modifying code. However, I am seeing more people turn to newer persistent implants/rootkits such as – atdre Jan 29 '15 at 15:49
Actually it appears that Avast, BitDefender, and BullGuard are the only three that can reliably detect Meterpreter. In particular, McAfee and TrendMicro will not even catch a Meterpreter which has not been obfuscated at all! What the heck! – atdre May 17 '15 at 19:26

Generally that sort of thing won't be found by a rootkit detector as it is only in RAM and rootkit detectors look for the obvious persistent elements a rootkit needs.

If this malware is RAM only then it can have the same ability to cause damage as other malware which resides in RAM. As @nealmcb pointed out, unless it can write to persistent storage, then a reboot will fix the issue entirely so generally it will not be much of a worry - it certainly won't be considered a rootkit.

However, as far as detecting a reboot, writing to disk and then moving back out to RAM and covering tracks goes - I wonder if Meterpreter based malware can do that. Theoretically it looks possible.

share|improve this answer
Hmmm - sounds like a worry to me - it can do a lot of damage until the next reboot. And wouldn't it be possible for malware using meterpreter to detect a reboot, and temporarily find a way to persist until the reboot, then erase those tracks and go back into memory? Not so robust as a rootkit, but harder to detect, it seems. – nealmcb May 21 '11 at 1:53
+1 agreed - I originally was just looking at it from the perspective of a rootkit. Updated as per your comment. – Rory Alsop May 21 '11 at 9:16
@techraf - no, it refers to the comment that exists here. – Rory Alsop Jun 23 at 5:57
How can it refer to a comment written 2.5 hours later? There were no edits to the answer. Unless migration messed something, but the content is also contradictory. – techraf Jun 23 at 5:58
sometimes SE does that on migration. – Rory Alsop Jun 23 at 6:40

With Meterpreter (some) common activities of an attack may include:

  1. Process injection/migration
  2. Password dumping
  3. Logging keystrokes
  4. Loading more malware
  5. Opening new ports/services
  6. Adding new users
  7. Uploading/downloading files

Some AV will pick up a plain meterpreter exe dropped on a system, if for example it's sent as part of a malicious document. (virus total link) But that can be quickly overcome with the use of the encoding framework.

As noted by others network based IDS such as Snort has signitures for Meterpreter (assuming the author didn't significantly modify the payload).

To detect this behavior you may want to look more towards a host based IDS. There is a better chance of detection with this type of system since HIDS look specifically for the behavior that I listed rather than file AV signatures. One very well known HIDS is OSSEC. I haven't tested it specifically with meterpreter but I would imagine that it would give a lot of alerts should the above activities be taken.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.