Hello,
The requirements, in general, look quite clear and straightforward to implement. Though, I have a couple of questions if you don't mind.
What is the exact netstat call that should be run, any specific argument? If I'm not mistaken the tool will get the connected ips and check these through virustotal to find out if there's any offending ones among them.
What exactly you mean with patch level? Is this something related to build/release id? Something like Windows 10 version 1234 maybe.
Is this supposed to be cross platform or just for Windows?
Depending on cross platform requirement I might either use c# or python. In any case, once the above points are cleared I expect this to take 5 days at most, thanks.