Malware Presence Confirmation – Koi Loader / Koi Stealer

  Introduction With the increasing complexity of cyber threats, analyzing network traffic has become a key method for detecting malicious activities. Koi Loader and Koi Stealer are types of information-stealing malware that communicate with remote command-and-control (C2) servers to transmit data and receive instructions. These malware variants rely heavily on HTTP and TCP communication to operate in the background without user awareness. In this project, a PCAP file containing network traffic from a system infected with Koi malware is analyzed using Wireshark. The focus is on identifying suspicious HTTP requests, abnormal TCP behavior, and repeated communication patterns to confirm the presence of malware. Objectives To analyze network traffic using a PCAP file To identify suspicious HTTP and TCP communication patterns To detect repeated connections with external servers To confirm malware presence through abnormal network behavior Malware PCAP File Link https://www.malware-traff...