poortry2.sys

POORTRY variant

From Unknown threat actor (Microsoft-signed)

Part of the POORTRY family

Status

On a known malicious list

Known variants

1 distinct hashes

Field notes

poortry2.sys is a variant of POORTRY, the WHQL-signed kernel malware publicly disclosed by SentinelOne and Mandiant in December 2022. Same toolkit as poortry.sys and poortry1.sys, distributed under multiple filenames. See the poortry.sys entry for the full story.

Not a legitimate vendor driver. Presence is evidence on the public record, not a verdict, but unlike most entries in this catalog there is no 'innocent why it's here' explanation.

What the record shows

poortry2.sys is listed as malicious on the public LOLDrivers project. One distinct binary hash matching this filename is on record.

What this means, plainly

Presence is not proof of misuse. This filename matches a public malicious list. Vera notes it as evidence on a record; the meaning still belongs to the people with the context.

Related drivers

Other drivers in the POORTRY family. See the whole family →

sense5ext.sys nodedriver.sys pciecubed.sys poortry.sys poortry1.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “poortry2.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/poortry2-sys