Python RAT Core Module
$99.99
Python RAT — Full Framework (Server + Agent + Generator)
Complete modular RAT in pure Python 3, single file: C2 server with interactive operator console, implant agent, and a standalone agent generator.
- Encrypted C2: AES-256-GCM with PBKDF2-HMAC-SHA256 (200k iterations, per-message random salt) when cryptography is available; otherwise a pure-Python AES-256-CTR + HMAC-SHA256 fallback with the same key derivation (AES validated against the NIST FIPS-197 vector).
- Operator console: agents / interact / task / results, per-agent task queues, result delivery over real HTTP.
- Agent capabilities: shell with timeout, upload/download, recursive pattern search, screenshots (Pillow optional), system recon (host, OS, CPU, memory, uptime).
- Anti-analysis: VM detection (DMI, hypervisor flags, systemd-detect-virt, MAC prefixes), debugger detection (sys.gettrace / IsDebuggerPresent / TracerPid), sandbox heuristics (uptime, CPU).
- Persistence: crontab, systemd unit, bashrc (Linux); Run key, Startup folder, scheduled task (Windows).
- Extensible: @CommandHandler.register plugin registry; generator emits a standalone agent file.
Verified end-to-end over real HTTP: register, queue tasks, execute, deliver results.
Key Features
- Complete framework in one file: C2 server with interactive console, agent, standalone agent generator
- AES-256-GCM with PBKDF2-HMAC-SHA256 (200k iterations, per-message salt) via cryptography, with pure-Python AES-256-CTR+HMAC fallback (NIST-validated AES)
- Anti-analysis: VM detection, debugger detection, sandbox heuristics
- Cross-platform persistence: crontab, systemd, bashrc (Linux); Run key, Startup folder, scheduled task (Windows)
- Tasks: shell (timeout), upload, download, search, screenshot (Pillow optional), sysinfo, persist, self-destruct
- Plugin registry: register custom commands with a decorator
- Agent generator writes a standalone agent script
- Zero hard dependencies; cryptography/Pillow/psutil optional
Requirements
- Python 3.8+ on C2 and target
- Optional: cryptography, Pillow, psutil (framework degrades gracefully)
- HTTPS termination recommended (reverse proxy) for production
Changelog
- 2.0 (2026-10-19): full implementation written from scratch (previous release shipped an empty module); verified end-to-end over real HTTP
- 1.5 (2025-04-10): README-only placeholder (retired)
Package Contents
Exact contents of the download archive (2 files):
| README.md | 2,135 B |
| rat_core.py | 35,975 B |
Related Tools
Malware Development
Process Hollowing Injector (C)
Malware Development
Reflective DLL Injection Template
Malware Development
Shellcode Encoder x86/x64
Malware Development