In a simple way? If I use VirusTotal (for example) how do I differentiate if it's just the RAT or if it's also backdoored? Or is there software to check?
The problem of assessing the security of "blackhat" software is, as you've mentioned, that many automated checkers will flag it due to it's purpose.
So this leaves you in a situation where you'd need to either "trust" the vendor, as @steffen-Ullrich says in comments or complete a manual assessment of the tool to ensure that it's doing what you want.
One approach to this would be to deploy the tool into an instrumented environment which can log changes in system files and network traffic and then put it through it's paces. Then review the logs provided to see whether the changes and traffic that was generated meet your expectations.
Of course this runs across all the possible problems of the tool having implemented anti-forensics technology either as part of it's primary purpose or as past of a backdoor.
If you have access to the source code you could obviously review that, and then ideally build from the source code you have. Assuming you've got the capabilities to complete that review, then that would provide more assurance.
Fundamentally it depends on how important it is to you to assure this software and the level of effort you're willing to go to.