Noob question, but was the application streaming over plain http, or did you do something to decrypt https traffic? How would you do the latter?

Edit: with mitmproxy and installing a cert in the phone's store, as explained in the latter half of the write-up. I guess that wouldn't work if the application pinned the server certs, but I guess this "commercial malware" is not that sophisticated.