ANTRATTER — Advanced Anti-RAT Protection System

Cross-platform 24/7 real-time protection against Remote Access Trojans.
Works on Windows, macOS, and Linux.

---

Features

Module	What it detects
ProcessScanner	Known RAT process names, system process spoofing, temp-dir executables, hash matching, excessive outbound connections
NetworkScanner	Suspicious ports, IRC/botnet channels, beacon heartbeats, DNS tunneling indicators
StartupScanner	Registry Run keys (Win), LaunchAgents/Daemons (macOS), systemd/cron/RC files (Linux)
FileScanner	Known RAT filenames, SHA-256 hash DB, high-entropy packers, double-extension tricks, PE import analysis
BehaviorScanner	CPU spike miners, shell-spawning exploits, clipboard theft, keylogger hook DLL detection

---

Quick Start

1. Install dependencies

pip install -r requirements.txt

2. Run a one-time full scan

python antiratter.py scan

3. Start 24/7 real-time protection (manual)

python antiratter.py protect

4. Install as a system service (auto-starts on boot/login)

# macOS / Linux
python install.py install

# Windows (run as Administrator)
python install.py install

---

CLI Commands

python antiratter.py scan           # Full system scan
python antiratter.py protect        # 24/7 daemon mode
python antiratter.py process        # Scan processes only
python antiratter.py network        # Scan network only
python antiratter.py startup        # Scan startup/persistence only
python antiratter.py quarantine     # List quarantined items

Flags:
  --auto-quarantine    Kill & quarantine threats automatically
  --no-notify          Disable desktop pop-up alerts
  --log-level DEBUG    Verbose logging
  --scan-path /path    Custom directory to scan

---

Architecture

ANTRATTER/
├── antiratter.py          # Main entry point & daemon orchestrator
├── config.py              # All tuneable settings
├── install.py             # System service installer
├── requirements.txt
├── database/
│   └── rat_signatures.py  # 200+ RAT names, hashes, patterns, mutexes
├── scanner/
│   ├── process_scanner.py
│   ├── network_scanner.py
│   ├── startup_scanner.py
│   ├── file_scanner.py
│   └── behavior_scanner.py
├── protection/
│   └── quarantine.py      # Kill, XOR-vault quarantine, registry removal
└── utils/
    ├── logger.py           # Color-coded console + rotating file log
    └── notifier.py         # Desktop alerts (osascript / notify-send / win10toast)

---

Quarantine

Detected files are XOR-obfuscated and moved to ~/.antratter/quarantine/.
A manifest.json tracks every quarantined item with timestamp, original path, and SHA-256.

---

Logs

All activity is logged to ~/.antratter/logs/antratter.log (5 MB rotating, 3 backups).

---

Requirements

• Python 3.10+
• psutil (required)
• pefile (optional — enables PE header analysis on Windows)
• watchdog (optional — enables real-time file system events)