← Back to driver explorer
Driver intelligenceMaliciousVerified
burntcigar.sys
BurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
burntcigar.sysSample 1 · HVCI unknown
- MD5
08cd822f1ef3e94616f75d484faf4d04- SHA1
3b4f4e6640e2e83f2caba72346972d9f7ab7f7e6- SHA256
7c5329b842cc3eaf1ec6c11b00e09a8c5e38ad14134b40a8bae3eda0a167a919- Imphash
ea8759ae7ba2da9ec0b60da2923829f0- Authentihash MD5
36b55c68011bcd05588c949b43501f33- Authentihash SHA1
7d3e874abbc4f315cbce8c2fbd76df826e20f813- Authentihash SHA256
31ce29a3ead6b843b40c9c08e08488e04eba209e13dd8cac7a4a28ab9250f401- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create burntcigar binPath=C:\windows\temp\burntcigar.sys type=kernel && sc.exe start burntcigarElevate privileges · Privileges: kernel · OS: Windows 10