#Trololo
Filter out all packets with the protocol RTP/RTSP/RTCP using the Wireshark filter `!rtp && !rtsp && !rtcp`. These are for some video stream that is not relevant to the malware. 
One of the remaining packets is a response for a GET request for `/content.enc`. The content of this packet seems to contain "encrypted" data. A lot of the bytes are the same value: `0xfd`. Furthermore, none of the bytes happen to be within ASCII range (they all have leading bit 1). This suggest that we should invert all the bits (same thing as xor-ing with `0xff`):
```Python 2.7.10>>> x = "0d0a0d0ac3c087...">>> import binascii>>> y = binascii.unhexlify(x)>>> print(''.join([chr(ord(a) ^ 0xff) for a in y]))```
The result is the following XML document:
```????<configuration>        <mailSettings>            <smtp from="[email protected]">                <network host="hermes.ndh2k16.local" port="25"/>            </smtp>        </mailSettings>        <NDHCrypto.Settings>            <setting name="EXT_TO_ENCRYPT" serializeAs="String">                <value>docx:doc:xls:xlsx:pdf:jpg:odt:ods:png:bmp:avi:mp4</value>            </setting>            <setting name="KEY" serializeAs="String">                <value>AD784DA62D1DDBB19B7F0500A52DD15C0BD70F924A5EF7C3CEA134C428747AFB</value>            </setting>            <setting name="SUBJECT" serializeAs="String">                <value>New infected</value>            </setting>            <setting name="IRC_SRV" serializeAs="String">                <value>irc://irc.ndh2k16.com:6667</value>             </setting>            <setting name="IRC_CHAN" serializeAs="String">                <valude>#Crypt0NDH2K16</value>            </setting>            <setting name="IRC_CHANPASS" serializeAs="String">                <value>orudeujieh6oonge4She</value>            </setting>        </NDHCrypto.Settings></configuration>```
The password (and therefore the flag) is `orudeujieh6oonge4She`.