The stealth technique involved placing a single flag byte in the data field of each ICMP (ping) packet, followed by the string "ABCDEFGHIJKL" as filler. Simply extracting the first byte from each 13-byte block was sufficient.
tshark -r file.pcapng -Y "icmp.type==8" -T fields -e data 2>/dev/null | python3 -c "import sys; print(''.join(chr(int(l.strip(),16)) for l in sys.stdin if l.strip())[::13])"