That's your only option.
But I haven't mentioned that it's an easy task, not to mention, if he's willing to send it back.
Bitcoin transactions aren't anonymous but hard to connect to an entity or a real-person.

If you're serious about finding the malware author or the owner of the address,
you can try to use services like "Chainanalysis" (it's a paid service) to conduct an investigation to possibly point you to the person behind it.