Can a scammer break out of a VM?
No, once upon a time there was an incident of this happening, but it was patched years ago. Even if an exploit did exist I have yet to find a scammer intelligent enough to do so. Just make sure your VM does not contain any personal information, such as accounts you have logged into, phone numbers, and stuff of the sort as they will attempt to steal your passwords.
How do I RAT someone?
Google a video for the RAT you want to use, they are all slightly different (I recommend NanaCore, Blackshades, Babylon, and R34P3R RAT (available upon request at http://hackersarise.co/), I plan to make a video on setting up a RAT and how to properly build and execute a stub sometime in the near future and will update this post at that time. All you require for a RAT is a computer, a router capable of port forwarding, and a brain. If you need a RAT that doesn't require port forwarding check here https://hackersarise.co/showthread.php?tid=170
Can RATting get you arrested in the US?
Absolutely, it is considered distribution of malware, and can also incur charges of illegally obtaining information, and conspiracy to commit fraud. I wouldn't worry about it too much, just don't do anything to get yourself caught. (moving the mouse, sending messages, leaving identifiable information)
Please note this is not a hacking forum, if your question/comment is construed as illegal (as ratting is) you can be banned, if you want to discuss hacking content my forum is dedicated to that at http://hackersarise.co