We know that the malware is stealing some application data, but we don't know which application it is and what data was stolen. Let's try to find this out by viewing the HTTP payload in the packet bytes (lowest pane) pane of standard Wireshark display as follows:
We can see from the preceding screenshot that the payload started with LokiBot version 18 in Decimal (12 in Hexadecimal) , and we need to divide that by 10 to get the exact version. Next, we had 27 as the identifier for data exfiltration on application credentials. Next, the first word denotes a width of zero, denoting that the payload value will be unpacked ...
