# kevthehermit/RATDecoders

Python Decoders for Common Remote Access Trojans

Repository: https://github.com/kevthehermit/RATDecoders
Canonical: https://ross.abutalabs.com/products/ratdecoders
Language: Python
License: MIT
License Family: permissive
Last push: 2024-07-16T06:32:07+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 4540, "days_push": 778, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1120, forks 306 (observed 2026-08-28T04:03:39.562361+00:00)

## What it is
A Python library and CLI tool (malconf) that statically analyzes malware samples from common Remote Access Trojan (RAT) families and extracts their embedded configuration data. It supports dozens of RAT families like DarkComet, njRat, and NanoCore, and can be embedded in automated malware analysis pipelines.

## Use cases
- extract configuration from a malware sample
- identify which RAT family a binary belongs to
- parse C2 server addresses from malware configs
- integrate malware config extraction into an analysis pipeline
- bulk analyze a directory of malware samples
- support incident response with malware configuration data

## When to choose
- you need to statically extract configs from known RAT families
- you are an incident responder or malware analyst handling common RATs
- you want a pip-installable library for automated malware triage

## When to avoid
- you need dynamic malware analysis or sandboxing
- the malware family is not in the supported RAT list
- you need general-purpose reverse engineering rather than config extraction

## Facets
- artifact type: library
- maturity: maintenance
- function: parser, security, developer-tools, cli
- domain: security, reverse-engineering, developer-tools
- platform: python, cli, cross-platform
- tags: malware-analysis, malware-configuration-extraction, remote-access-trojans, incident-response, yara, threat-intelligence

## Member repositories
- kevthehermit/RATDecoders (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:39.562361+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:41:06.559633+00:00, confidence not recorded.
  - readme: https://github.com/kevthehermit/RATDecoders (fetched 2026-08-28T04:03:39.562361+00:00, sha 92df300f2b54)
- Data as of 2026-08-30T08:39:29.467469+00:00.