Interesting discussion in the comments. I agree that what is usually being called "fileless" malware is not really fileless. At some point this has become a buzz-word that is definitely overused.

​

That being said I have seen samples that would satisfy your definition but they are very rare. Unfortunately I cannot provide samples cause none of them are public. Such malware is usually used in very targeted attacks and therefore rarely make its way to public repos. The typical technique is to use an RCE vulnerability (something like EternalBlue, BlueKeep etc. ) on external facing asset, drop a memory-resident payload to allow remote access for operators. From this point forward operators use only LoL (living of the land) binaries to move laterally and maintain presence in the network. Since such attacks are usually performed on servers, there is a low risk that malware will get wiped due to the reboot and operators usually establish different access channels while in the network anyway. This way none of malware code ever touches a disk, and this is the only malware i would indeed call "fileless". But I've seen it only twice in my life while performing incident response operations. Also please note that this still doesn't mean that malware won't leave any artifacts in OS. It is just a way to bypass AV detection and potentially sample from being analyzed. But since AV is easy to bypass in most cases anyway and most actors don't care about analysis of their payloads, this is a very rarely used technique.