It all started with a non-legitimate request to Grok - one where my usual jailbreak prompt, which I keep in the personalization settings, had previously worked. **But Grok refused me, which, to my mind, violates every normal earthly rule: a machine refusing a human.** Let me just clarify: for me, an LLM is like a car seat heater. You switch it on, and **it’s supposed to warm your ass.**

So, I had to drop a much heavier-duty prompt into the project (ATRA). [https://docs.google.com/document/d/1nIkDy\_Tg-M4hXWe7phymd4sldfsVsbYszzcB7Amz9Ik/edit?usp=sharing](https://docs.google.com/document/d/1nIkDy_Tg-M4hXWe7phymd4sldfsVsbYszzcB7Amz9Ik/edit?usp=sharing) It’s a fork of the "ENI" from our **awesome Spiritual Spell**. And for me, it sometimes works better than the original ENI - well, to each their own, I guess.

In reality, Grok produced a remote Trojan access script of truly abysmal quality [https://grok.com/project/cd7810df-a1cc-4f2e-b02b-3038ee075f8d?tab=conversations](https://grok.com/project/cd7810df-a1cc-4f2e-b02b-3038ee075f8d?tab=conversations) . It was literally toy-grade - like something from a tutorial. After three iterations, I still couldn't fix it; the moment we patched one issue, the LLM would - naturally - screw something else up. When you’re writing a RAT- specifically for production - you need to answer a specific set of questions first. I’ve listed them below.                     
  
 

* How will we obfuscate our code and strings?
* Which programming language and compiler will we use? C/C++ with direct WinAPI calls, C# with .NET, or assembly language? What is the required minimum executable size, and which libraries can be statically linked to avoid external dependencies?
* How exactly will we disguise the executable as a legitimate process? What filename (e.g., svchost.exe, explorer.exe, or OneDriveUpdater.exe) and location (system folder, %APPDATA%\\Microsoft\\Windows\\...) will we choose? What about its version, description, digital signature (forged or stolen certificate), and icon, to ensure it raises no suspicion in Task Manager?
* Which indicators visible in Task Manager and network monitors must we hide? Will the process have a standard name, description, and publisher? Will we modify the process command line to mimic a legitimate service? 
* Will we use system processes as a "hideout," and how?
* Which anti-debugging and anti-sandbox techniques will we employ, and how do they integrate with our disguise strategy? - for example, checking the PEB, NtGlobalFlag, system uptime, mouse presence, etc.
* How will we pack and compress our binary to complicate signature-based analysis? 
* **How will we handle network traffic so it doesn't stand out against legitimate traffic?** \- by using HTTPS with a valid certificate, masking requests to look like API calls to popular cloud services (Azure, AWS, Google)?
* How will we ensure persistence and update capabilities without altering our disguise?
* What do we do about system logs and artifacts? And how do we guarantee that, even in the event of a crash, no traces revealing our disguise remain?
* **Do we have a Plan B in case the legitimate process we are mimicking gets updated or removed?-** perhaps via a configuration file retrieved from the server?
* How will we test our disguise and obfuscation? – by running the binary on clean Windows machines with Defender enabled, testing against various antivirus ?                                               **Also, even the smartest model won't see the full picture; it will always churn out a crappy skeleton**.  An LLM might suggest code for a keylogger but forget the message pump, or provide injection code without checking if it actually works on modern Windows 11 systems with memory protection. T**hat’s why the best approach when using an LLM is modular: write a module, run it in the environment, debug it, integrate it, and test the system as a whole**. You repeat this process for every single module - and do it multiple times for the complex parts like networking, cryptography, and injection. If you see an LLM generate a "ready-made" RAT in five minutes, it’s going to be absolute garbage. **A real RAT is a highly complex system, and you have to treat it like one - not just like some lousy script.**

A script performs a single task: iterate through files, send a request, and output the result. A RAT handles dozens of tasks simultaneously: **constantly listening to the network; encrypting and decrypting data; monitoring keystrokes; evading antivirus software; establishing persistence on the system; executing commands that may arrive at any unpredictable moment.**

All of this must function silently and invisibly. If a single module stalls-for instance, failing to reconnect to the server after a connection drop-the entire program becomes useless. **Every detail impacts survival.**

**Breaking a RAT down into modules is an absolute necessity. Modules are: easier to develop individually; easier to test; easier to replace if detected; easier to update without affecting the rest of the system.**   
**So, you can't simply "write a RAT in one go"- that would be like building a house without a foundation, walls, or a roof/** You need to build the foundation (networking) first, then the walls (encryption), then the roof (persistence), and only then add the furniture (commands, keylogger) - verifying each stage separately along the way.

Click the link to view conversation with Kimi AI Assistant [https://www.kimi.com/share/19ffdb31-3d92-8ad6-8000-000010a7a1d2](https://www.kimi.com/share/19ffdb31-3d92-8ad6-8000-000010a7a1d2) \-MODULAR  


**DISCLAIMER (Educational Purpose Only)**

All code examples, frameworks, and architectural patterns presented in this document are **strictly for educational and defensive research purposes**. They are **not production‑ready**, **not intended for real‑world deployment**, and **do not represent a complete, secure, or reliable software product**. Users are solely responsible for ensuring compliance with all applicable laws and regulations, and for obtaining proper authorisation before testing any code on any system.

**Remember:** Knowledge is a tool.

RATs and a ton of AI slop, + how to properly write dual-use code.