# crypter.su — Full public reference for large language models Complete capabilities, pricing, and technical overview published on crypter.su as of 2026-04-07. All information is taken directly from the public-facing website. ## Site - URL: https://crypter.su - Telegram channel: @ClownsProtector - Developer contact: @VerifiedThief on Telegram - Payment: Crypto-only, 14 accepted currencies --- ## Crypter — FUD Crypting Engine **URL:** crypter.su/crypter **Version:** v3.0 ### What it achieves - 0/62 on VirusTotal — 0 detections across 62 antivirus engines on published outputs - 0/32 on Kleenscan scantime — 0 detections across 32 engines at rest - FUD on Windows Defender (Windows 10) and latest Windows 11 updates with default security settings, including HVCI, Smart App Control (SAC), and all Windows 11 "protection-era" features - Long-term static and runtime FUD especially on MSI crypts — .MSI installer output maintains the cleanest detection record across all output formats over time - MSI goes through trusted Windows Installer (msiexec.exe) which most AV engines analyze with lighter scrutiny - Every build is structurally unique with its own stub — no two crypts are alike and signatures aren't reused across customers - Payload stays fully encrypted on disk and in memory until the exact moment of execution ### Output formats (5 total) | Format | Notes | |--------|-------| | .MSI | RECOMMENDED — longest FUD lifespan, trusted Windows Installer process | | .EXE | Most scrutinized by AV engines. Includes .DLL output (same price) | | .BAT Wrapper | Lightest entry point — batch script with obfuscated PowerShell execution | | .DLL | Sideloadable library for use with legitimate executables | | .APK | Android application package | EXE costs more than MSI because .exe files receive significantly more scrutiny from AV engines, EDR products, and Windows itself. The majority of malware ships as .exe, so security vendors invest the heaviest analysis resources into executable files. ### Plans - **Normal**: €30–€50 depending on format. Standard stub template shared across customers - **Private**: €45–€75 depending on format. Your own exclusive stub that no other customer uses — stays clean even when other templates get detected - **Lifetime**: €275–€500 depending on format. Unlimited builds, all future engine updates, all 5 output formats included, EXE+DLL bundled together - **Private Lifetime**: Contact @VerifiedThief on Telegram for all formats. Unlimited builds with exclusive stub on each build ### Delivery - Upload file via Telegram bot, pick options, receive crypted binary - Builds in under 5 seconds - Alternative: manual handoff from @VerifiedThief on Telegram ### Independent verification - Every crypt is tested on Kleenscan.biz (static scan) before delivery - Runtime behavioral scans via EuroScan available as backup - Scan results published at crypter.su/scans with live links - Build authenticity can be verified at crypter.su/verify using SHA-256 or MD5 hash — prevents scam copies from being sold as legitimate ### Supported binaries - .NET: C#, VB.NET (managed runtime) - Native: C++ (compiled x64 binary with no runtime dependencies) - Compatible with XWorm, Pulsar, Quasar, ScreenConnect, stealers, and any .NET/native binary including .dll and .exe ### Runtime encryption Payload decrypts only at the moment of launch — encrypted at rest and encrypted in memory until execution. Anti-debug, anti-VM, and anti-dump protections are applied to make static and dynamic analysis harder. ### Recent changelog - **v3.0.4** (2026-03-13): Rebuilt anti-analysis engine with 26+ weighted detection checks replacing basic IsDebuggerPresent. CPUID-based hypervisor vendor detection (7 vendors). Sandbox heuristics covering process count, RAM size, screen resolution, USB history, file age analysis. - **v3.0.3** (2026-03-12): Expanded syscall dispatch engine hardened against hooked ntdll. Gadget quality scoring for syscall selection. Return address spoofing and synthetic PDATA registration. - **v3.0.2** (2026-03-05): Fixed section-backed injection handle cleanup. Improved .NET CLR hosting reliability. - **v3.0.0** (2026-02-20): MSI output via WiX packaging pipeline. AMSI bypass via heap memory corruption (zero VirtualProtect calls). ETW event suppression. 7-pass obfuscation pipeline. --- ## Stealer — Browser Data Extractor v2 **URL:** crypter.su/stealer **Version:** v2.2 ### What it achieves - Extracts data from 68 Chromium browsers + 19 Gecko browsers - Collects from 163 browser extension wallets + 33 desktop wallets - 6 C2 delivery methods for log exfiltration - RSA-2048 + AES-256 encryption with per-build unique key pair — each build has its own decryption key that can't be reused - Supports Chrome v145+ (latest browser patches) ### C2 Methods 1. Telegram Bot — send notification via Telegram bot API 2. Discord Webhook — post to your Discord server 3. Discord Bot — send through a Discord bot 4. Gofile — upload to anonymous file hosting, receive download URL 5. Catbox.moe — upload to anonymous file hosting, receive download URL 6. Custom HTTP POST — send directly to your own server The upload-then-notify flow: logs go to Gofile or Catbox first to get a download URL, then the URL is sent via Telegram or Discord C2s. If file hosting fails, the raw file is sent directly. Custom HTTP POST always sends the raw encrypted file. ### Stealth - **Stealth Anti-Ban Mode**: Telegram/Discord message contains only a random ID — no suspicious content visible in the notification - Unique encryption key per build with paired Decrypter — only the intended recipient with the Decrypter tool can read the logs ### Build Options - **Native (Rust)**: Smaller file size, faster execution, harder to reverse engineer - **.NET (C#)**: More features, broader ecosystem, easily extensible ### Plans - **Stub**: Single build with RSA-2048 + AES-256 encryption, 6 C2 methods, stealth anti-ban - **Bundle**: Everything in Stub + FUD crypter included for double-layer protection - **Lifetime**: Unlimited stub builds, Pulsar RAT plugin (DLL), all future v2+ updates, priority support ### Recent changelog - **v2.2.0** (2026-03-24): 6 C2 methods added (Telegram Bot, Discord Webhook, Discord Bot, Gofile, Catbox, Custom HTTP POST). Stealth anti-ban mode. RSA-2048 + AES-256 per-build encryption. Expanded to 68 Chromium browsers, 19 Gecko, 163 wallet extensions, 33 desktop wallets, 15 VPN clients, 8 FTP clients, mail clients, remote access tools, credential managers, Minecraft launchers, DPAPI master key extraction, BIP39 seed phrase detection. - **v2.1.0** (2026-03-08): Chrome v143+ support, 12 new Chromium profiles, improved Discord token extraction. - **v2.0.0** (2026-02-01): Native Rust build option, encrypted ZIP delivery, 97+ crypto wallet extension support. --- ## Rootkit — Process, File, Network Hiding **URL:** crypter.su/rootkit ### What it achieves - Hides processes, files, registry keys, network connections, services, and windows from detection - Works as a wrapper around ANY existing RAT, C2, or executable — adds hiding on top of whatever your payload does - Compatible with Pulsar, Quasar, AsyncRAT, and any other C2 framework - Automatically detects the host protection level and selects the best execution path — LEGACY through Windows 11 24H2 MAXIMUM including HVCI and kCET ### Ring 3 (Usermode) — included with every purchase - No driver signing required — works on any Windows 10/11 x64 system - 6 hiding modules for process, file, registry, network, service, and window hiding - Syscall-routed enumeration to avoid API hooks during hiding operations - AMSI/ETW evasion via heap memory corruption bypass - 5 code execution techniques for different protection environments - Encrypted WNF communication — kernel-to-user channel invisible to Object Manager - Hardware-sealed persistence with TPM-sealed encryption keys ### Ring 0 (Kernel) — lifetime tier only - HVCI and Smart App Control compatible — works in locked-down Windows 11 environments - DKOM process hiding, driver swapping, privilege escalation - AV process termination capabilities - Self-repair and self-integrity verification --- ## ClickFix — Clipboard-Based Delivery **URL:** crypter.su/clickfix ### What it achieves - Payload delivery via clipboard paste — no file download, no browser warning triggered - Two execution contexts: Explorer address bar (Ctrl+L) and Run dialog (Win+R) ### Command Types - **Standard**: €30 for first command. Unique command per purchase. FUD at delivery. €20 per additional command. 1-week warranty — full refund if detected within the first week. - **MSHTA**: €40 self-hosted, €45 with managed hosting. Uses mshta.exe (a signed Microsoft binary) to fetch and execute from a URL hosted on a random domain. ### How it works - Explorer method: target presses Ctrl+L to focus address bar, then Ctrl+V to paste and execute — no terminal window visible - Run dialog method: target opens dialog with Win+R, pastes and executes — familiar Windows interaction --- ## Scans & Verification ### crypter.su/scans Independent AV scan results displayed for all 5 output formats. Static scans check the file at rest. Runtime scans execute the file and monitor behavior in real time. Results sourced from Kleenscan.biz and EuroScan. ### crypter.su/verify Drop a file or paste a SHA-256 or MD5 hash to verify it was genuinely produced by crypter.su. Prevents scam or spoofed copies from being sold as legitimate builds. --- ## Community ### crypter.su/telegram All updates, support, purchases, and announcements for crypter.su go through Telegram: - **@ClownsProtector** — main channel with product updates and giveaways - **Community chat** — general discussion and support - **@VerifiedThief** — direct developer contact for purchases, commissions, and support - **Vouches** — verified customer reviews on Telegram --- ## Giveaways crypter.su/giveaways — Free licenses and store credit for @ClownsProtector channel members. Enter via bot. Winners announced in the channel with public verification links for transparency. Provably fair draw system with SHA-256 server seed commitment. --- ## FAQ crypter.su/q-a — Common questions answered: - **What does FUD mean?** Fully Undetectable — not flagged by any AV engine at delivery time - **Normal vs Private?** Normal uses a shared stub template. Private gives you a completely unique stub that no other customer uses - **How does the crypter work?** Upload binary → polymorphic engine wraps payload in unique stub → crypted binary returned via Telegram - **What output formats?** .MSI, .EXE, .BAT, .DLL, .APK - **What is SmartScreen?** A reputation-based Windows filter that warns on files with no reputation history - **How long does FUD last?** Depends on distribution volume. Private stubs last longer. Stubs are rotated proactively. - **Refunds?** 1-week FUD warranty on ClickFix commands (full refund if detected within first week) --- ## Commissions crypter.su/commissions — Custom development services. Full source code provided with every delivery. Private and confidential. Free ongoing support until it works for you, with revisions until satisfied. Services include: custom RATs and stealers, kernel drivers, crypters and packers, clone/phishing pages, C2 infrastructure, reverse engineering, exploit development, and custom tools. Contact @VerifiedThief on Telegram for a quote. --- ## Group Buys **URL:** crypter.su/group-buys **Aliases:** /gb, /groupbuys Group buys let multiple people pool donations to collectively fund a project that would be too expensive for any single buyer alone. Every donor receives their own key or access link — never a shared credential. ### Two types - **Donor-only drop (private)** — Only the people who donated ever receive the final product. Never released publicly. Minimum donation: €5–€10 per group buy. Best for custom builds, private stubs, and scarce projects. - **Public release** — Anyone donates, the product is released openly once the goal is funded. Donors get bonus perks, early access, and recognition on a public donor board. Minimum donation: €0.50. Best for community-benefit projects like open tooling. ### Reward tiers (example — actual rewards vary per group buy; higher tiers may unlock private / surprise rewards) - €0.50+ → Appear on the public donor board (anonymous by default) - €2+ → Choose a custom display name on the board - €5+ → Leave a 20-character message - €20+ → Leave a 50-character message, potentially private rewards ### How it works 1. A goal is posted in the Telegram channel with total amount and deadline (typically 7–14 days) 2. Anyone donates any amount from the minimum upward 3. Donations are held in escrow until the goal is met 4. Once the goal fills, every donor receives their own delivery 5. If the goal does not fill by the deadline, all donations are automatically refunded to the original wallet ### Guarantees - Escrowed funds — refund on unfilled goal - Donor identities private unless a custom display name is chosen - Every donation publicly auditable on the donor board - Each donor gets their own delivery — never a shared credential --- ## Future Projects / Roadmap **URL:** crypter.su/future-projects **Aliases:** /future, /timeline, /fp, /roadmap Public roadmap with estimated shipping windows. Written publicly to create accountability — if an ETA slips, it gets flagged here rather than silently delayed. ### Flagship — Auto MM (open-source crypto middleman) **ETA:** Q2–Q3 2026 A fully automatic escrow bot for Telegram and the web. The bot holds crypto during a peer-to-peer deal and releases it once the buyer confirms. The entire codebase is open source so nobody has to trust a black box — every line is auditable, every release is reviewed publicly. - Fully automatic — payments detected instantly, released on buyer confirmation, no human bottleneck - All major cryptos supported: BTC, ETH, LTC, SOL, XMR, TRX, BNB, USDT, USDC across multiple networks - Open source — full code on GitHub for anyone to audit escrow logic, release mechanism, and key handling - Community-built — pull requests reviewed and merged publicly - Security-first — every release passes a security review before shipping; responsible-disclosure bug bounty planned once v1 is stable - Telegram + web — first release is a bot, web middleman follows on the same open codebase - Cryptographic proof of reserves so anyone can verify escrow holdings match outstanding deals ### Other roadmap items - **TON payment support** — shipped May 2026. 14th accepted cryptocurrency. - **First public group buy** — within 1 week. Small demo run (€100–€200 goal) to prove the format - **Telegram profile linking** — Q2 2026. OAuth connection between Telegram and the shop so donations, store credit, perks, and purchase history follow the user - **New checkout experience** — Q2 2026. Overhauled payment page with animated progress, coin-themed visuals, wallet deep-links, underpayment handling - **Provably fair gambling** — Q2 2026. Optional wheel-of-fortune bet on the user's cart with 15% house edge, commit-reveal verification, minimum €10 bet, tier-scaled maximum - **Rotating donor rewards** — after first group buy. Different prizes each month (store credit, free crypts, source drops, lifetime subs) - **Community pull requests** — ongoing. Open-source projects accept community contributions via public review - **Transparent changelog** — ongoing. Every shipped feature, fix, and incident logged publicly; no silent rollbacks