Oyster Malware C2 Traffic

Kaung Khant Ko@kaungkhantko

•updated Oct 17, 2025•8•1•276

Detects HTTP requests indicative of Oyster malware C2 beaconing, including GET requests to /reg with WordPressAgent User-Agent and application/json Content-Type, GET requests to /login with FingerPrint User-Agent, and GET/POST requests to /api/kcehc or POST requests to /api/jgfnsfnuefcnegfnehjbfncejfh.