NeacSafe64.sys
NetEase NeacSafe64.sys is an anti-cheat minifilter driver. Public NeacController research documents arbitrary kernel writes (opcode 70) in the 2025-02-20 sample, SHA256 65447f727801e8be8a51aaaafc07618c8196553e683affb0721da441e2430bad, associated with CVE-2025-45737. Separate research on the added 2026 FragPunk, Overwatch China and NARAKA builds reports that opcode 70 has been stubbed, while unauthenticated filter-port messages still expose process termination (opcode 20), process-protection changes (opcode 33), a pool overflow (opcode 52), and a system-crash path (opcode 63). The researcher reports termination and protection stripping of PPL processes. The filter port permits one connection, so an existing client can prevent access. All these builds report version 1.0.0.0 despite differing capabilities; use sample hashes to distinguish them. The older CVE's arbitrary-write claim is not applied to the added samples.
Known samples 4
0 recorded TRUE · 0 recorded FALSE · 4 unknown for loading despite HVCI. Results apply to individual samples.
NeacSafe64.sysSample 1 · HVCI unknown
- MD5
dcc288fafad0bf3b505c4b44791d423d- SHA1
7e6dd5f1363c3070c59378ec8b23b6ec7b5671b4- SHA256
65447f727801e8be8a51aaaafc07618c8196553e683affb0721da441e2430bad- Imphash
7a377a157a35494d3fc033245b7fd077- Authentihash MD5
9caa8f73259bba3021b7384c637db9fe- Authentihash SHA1
5c41fa80052c332f7d6323c91e84e1204ba1c1c7- Authentihash SHA256
caac9e1cbeaf4c1e05298e9b0f29468b35a36badd443eb6146e59c5fe520a52e- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- 网易(杭州)网络有限公司杭州
NeacSafe64.sysSample 2 · HVCI unknown
- MD5
1607f41c32e67edf39d0968f332aef9f- SHA1
555c8c25dee0a3c23256f9f9b66ce274f7b15aa1- SHA256
1d828fe7d97620cd92275c6d14fe9721c9b04b514f4dce084f7f6ea05b7d5acd- Imphash
30a629a38af80951a4e2301ee1d5feee- Authentihash MD5
aa2591313be9f531805de3ddb4071d61- Authentihash SHA1
00b873ecb9ee4ff59a76ba1f4b99531d4eac466b- Authentihash SHA256
9a44bc8e37db8fd7bcfab61e7236418377510816da3a8a20edd84d26284c5980- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
NeacSafe64.sysSample 3 · HVCI unknown
- MD5
ebfad15f91e3e4bd7f538c96dc855924- SHA1
5b8194c13270963c29e5fa2e0ab01cc6fba4b786- SHA256
f79a4ba7f5656fa9ccfe245a90e6e861e2d1aaf0f9d52240abaad0521da063be- Imphash
c4d7f42aad938be2184b7e1be80216f8- Authentihash MD5
a9c6084cc45f63c0b82f8ed9bc79542e- Authentihash SHA1
e2b9255e5554b1568a01b91e9f65389926b5e377- Authentihash SHA256
3f26c7056416b92aaaa01aaa95ee4bed44eab881a476df7b80cd5a189e0daeaf- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
NeacSafe64.sysSample 4 · HVCI unknown
- MD5
7296e9a1ef2e6aaafc6915e1eb552780- SHA1
8bc89c4564188385709a04fc941c82586febe771- SHA256
b1147d9b4bed22d8b6e6dcc7366950ffb57ecc10fbfe8f4ee9615b3d3cdd2368- Imphash
36579a94b168b84abb2af8cc819813e2- Authentihash MD5
64de48508b489bc662ce758872ec4c9c- Authentihash SHA1
1bc1927f305fc59a800b5cc025c5e1517c7683b1- Authentihash SHA256
094c3832057096dd966add98530f24fbcef27204b981a4d0bbbdba8dfb3eb2b3- Machine
- AMD64
- Version
- 1.0.0.0
- Publisher
- Microsoft Windows Hardware Compatibility Publisher
Recorded command
sc.exe create NeacSafe64 binPath=C:\windows\temp\NeacSafe64.sys type=kernel && sc.exe start NeacSafe64Abuse vulnerable message handlers for kernel writes in the older sample, or process termination, protection changes and denial of service in the added builds. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: za233, hax0r31337 @za233, @hax0r31337