Shellter Editions Feature Comparison Table

FeaturesShellter FreeShellter ProShellter Pro Plus
Basic PolymorphismYYY
Basic EncodingYYY
Basic User-Defined Encoding SequenceYYY
Dynamic Thread Context Key

IAT HandlersYYY
MSF Compatible StagersYYY
Custom Payload SupportYYY
Reflective DLL Payloads SupportYYY
Preserve target PE Functionality

(Stealth Mode)
32-bit PE (.exe) supportYYY
32-bit PE (.dll) supportYY
64-bit PEs (.exe, .dll) supportYY
PE Target Compatibility CheckYY
Graphical User InterfaceYY
Standalone EncoderYY
Advanced PolymorphismYY
Enhanced Anti-AV Signature TechnologyYY
Advanced Multi-Layered EncodingYY
Advanced User-Defined Encoding SequenceYY
PE Target Size Increase for AV Pre-Filter EvasionYY
Extra Built-In MSF Compatible StagersYY
Multi-Payload ChainingYY
Advanced Stealth Mode Reliability supportYY
Execution Flow Data FilesYY
Execution Flow Tracing Using Target PE-Specific ArgumentsYY
MSF Console Scripts Generator

(Applies to embedded stagers)

(Restore/Replace/Add Certificates In PE targets )
Large Payloads SupportYY
PE target Relocations Support

(Dynamic Image Base)
MSF5/6 Compatible Embedded StagersYY
Discord Server

(Access to a private channel where we discuss potential improvements and exchange tips and hints with our customers.)
Advanced Debugger Detection (KM + UM)

(Payloads won’t fire if detected. Can be combined with ‘Decoy Payloads’ feature to conceal real functionalities and/or tamper with automated sandbox analysis results.)
Advanced VM/Sandbox Detection (Type 1 + Type 2 Hypervisors)

(Payloads won’t fire if detected. Can be combined with ‘Decoy Payloads’ feature to conceal real functionalities and/or tamper with automated sandbox analysis results.)
Decoy Payloads

(Execute if DBG/VM are detected. See above.)
Advanced Self-UnhookingY
Advanced Heuristic Unlinking of AV/EDR ModulesY
Advanced Native Imports Redirection For Loaded ModulesY
Advanced Native SysCalls-Based Runtime EvasionY
Advanced Stealth Payload Thread Creation

(Applies to the main thread of the payload)
Advanced Self-Process and Payload Threads ProtectionY
Advanced ETW Evasion

(Applies to the process executing your payload)
Advanced AMSI Evasion

(Applies to the process executing your payload)
AES-128 Payload Encryption

(Embedded + Network fetched keys)
Ambush Payload Execution

(Keeps payloads in hibernation until a specified benign DLL is loaded by the process)
Anti-DLL Load Monitoring

(Removes user-mode callbacks registered to monitor DLL modules loading events)
Dynamic checks of newly loaded modules against hooks and other artefacts.

(Intercepts module load events in real time)
Enhanced Application DLL BackdooringY
Enhanced Windows Built-In Modules CompatibilityY
Targeted Runtime EvasionY
Memory Scan Evasion

(Removes suspicious access permissions from all proprietary memory allocations, encodes/decodes functions and data members on the fly and cleans dynamically-built strings from current thread’s stack memory)
Total Recall

(Eradicate in-memory traces of our code under certain circumstances)
Infected Binary Watermarking

(Insert a user-defined watermark to help clients identify infected binaries during/post security engagements)
Shellter Editions Feature Comparison Table [PDF]


We do not support nor condone illegal activities in any shape or form. This software is offered with the sole purpose to assist ethical hackers in their daily jobs during Penetration Testing and/or Red Team engagements. The author of this software and INSAINTED LTD assume no responsibility for any unlawful actions taken and any damages caused by using this software.

AV Evasion Artware