In 2018, Check Point published a deep dive into SiliVaccine, North Korea’s homegrown antivirus, and found its scanning engine was built on stolen, decade-old Trend Micro code. Check Point also named two suspected authors: the North Korean state IT company known as PGI, and STS Tech-Serv. (https://research.checkpoint.com/2018/silivaccine-a-look-inside-north-koreas-anti-virus/)

A new version of SiliVaccine has surfaced and a lot has changed since 2018.

The install screen

The installer path reveals a company name: CRB Security Corp (C:\Program Files\CRB Security Corp\CVaccine). While not the exact same match, RB Corp has been seen in other DPRK software like NetKey/OConnect, and RB Site and RB Corp has been referenced as internal sites for project tracking https://flare.io/learn/resources/north-korean-infiltrator-threat

More interesting: the internal RPC namespace inside the main executable, com.pgi.rpc, points straight back to PGI, the same company Check Point named as a suspected SiliVaccine author back in 2018. PGI also shows up in the certificate metadata of Hangro, North Korea’s VPN client, a completely separate product.

The Trend Micro code Check Point found in 2018 is gone. This version is built on, ClamAV signatures for the base scan engine, plus Malheur, an open source tool for behavioral malware clustering (https://github.com/rieck/malheur), as a second scan mode. The developers don’t hide this either the right-click context menu literally has an option called “ClamShell-Malheur.” The ClamAV signatures are out of date, there is an update component that ships with the software which would assuredly update the definitions.

I pulled the MD5 hashes and family labels for the 102 samples used to train Malheur’s clustering model (attached at the bottom). A quick pass shows none of them turning up on VirusTotal. Worth noting the set is mostly generic: about two-thirds of it is a single unremarkable file family (W32/Virux), so this doesn’t look like a curated DPRK malware collection.

The names discovered in the files is also worth mentioning as it appears that SiliVaccine is no longer the main name of the software. SiliVaccine is the internal build/CI project name where some Jenkins build strings were left behind. KVACCINE shows up as the main name for most of the files and binaries (kvmain.exe, kvshell.dll, kvcore.bin). BlueStream is the internal project name for at least one component. CVaccine is the install folder name. And 청류벽 (Cheongryubyeok, “Clear Stream Wall”) is what actually ships to users.

Toggles across the top are 실시간감시 (real-time monitoring, on), 행위검출 (behavior detection, off), 방화벽 (firewall, on), 침입검출 (intrusion detection, off). Sidebar: 검사 (scan), 설정 (settings), 방화벽 (firewall), 기록 (log), 제품정보 (product info). The four scan modes are 주기억검사 (memory scan), 체계구역검사 (system area scan), 선택검사 (custom scan), 예약검사 (scheduled scan).

File-type scan options (executables only vs. all files, size caps, compressed file scanning with a 50MB cap), detection handling (currently set to “scan only,” with quarantine on failed removal), USB scan options, an unchecked “use Windows Defender” box, firewall options (disable auto-share, alarm on blocked packets), intrusion detection (ARP spoofing block, DDoS block with a 60-second block window), and update settings with a server-address vs. local-path toggle and an “auto-update every 2 hours” option, currently unchecked.

• Memory scan: scans currently running programs; if an infected process or system file is found, handling proceeds “according to the user’s decision,” considering system stability; described as mandatory, to run before other scans.
• System area scan: scans the boot drive’s Windows registry area (특로부, a native-Korean coined term standing in for the loanword “registry”) and other important system files; recommended to run often.
• Scheduled scan: runs automatically at a set time on registered targets, configurable via a settings button; described as convenient since it runs without user involvement.

Product name field reads 비루스왁찐프로그람 《청류벽》 (“Virus Vaccine Program ‘Cheongryubyeok'”), version 4.2.33.18, a device ID (6578-1914-6230-3592-2581), and an unregistered license prompt.

I haven’t had time to dig into this more but a few other interesting points from a quick analysis of the software

• The product embeds a 96-bit RSA public key (secpub.dat).
• There’s a guarduser.dll is a thin wrapper around a kernel driver called ClamGuarder
• A recurring Japan-linked thread across three separate components (Japan’s JPKI national ID driver, Dai Nippon Printing and Fujitsu smart card entries, and a locale file with Japanese-language column headers) that you’re planning to chase later, worth a one-line tease without resolving it.
• One of the files inside kvcore.bin decodes to a long list of Windows registry Run/RunServices/Winlogon persistence entries tied to known malware.
• nat-traversal.softether-network.net is included in kvmain.exe which is used by SoftEther VPN’s public NAT-traversal

Malheur hashes: https://nkinternet.com/wp-content/uploads/2026/08/malheur_prototype_samples.csv