BurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.
sc.exe create burntcigar binPath=C:\windows\temp\burntcigar.sys type=kernel && sc.exe start burntcigarsc.exe create burntcigar binPath=C:\windows\temp\burntcigar.sys type=kernel && sc.exe start burntcigarSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
BurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068