Unraveling a mystery that eluded the researchers analyzing the highly advanced Equation Group the world learned about Monday, password crackers have deciphered a cryptographic hash buried in one of the hacking crew's exploits. It's Arabic for "unregistered."

Researchers for Moscow-based Kaspersky Lab spent more than two weeks trying to crack the MD5 hash using a computer that tried more than 300 billion plaintext guesses every second. After coming up empty-handed, they enlisted the help of password-cracking experts, both privately and on Twitter, in hopes they would do better. Password crackers Jens Steube and Philipp Schmidt spent only a few hours before figuring out the plaintext behind the hash e6d290a03b70cfa5d4451da444bdea39 was غير مسجل, which is Arabic for "unregistered." The hex-encoded string for the same Arabic word is dbedd120e3d3cce1.

"That was a shock when it popped up and said 'cracked,'" Steube told Ars Monday evening. He is the developer behind the free Hashcat password-cracking programs and an expert in password cracking.

As Ars reported Monday , Equation Group was a highly advanced malware operation that remained hidden for at least 14 years. In 2008 the group used four zero-day vulnerabilities—including two that were later incorporated into the NSA-led Stuxnet worm that targeted Iran's nuclear program. Kaspersky uncovered a mountain of evidence that built a convincing case Equation Group was an NSA operation that infected tens of thousands of computers with extremely advanced malware, some of which resided in the hard drive firmware of targeted machines.

The complexity and skill of Equation Group seems almost superhuman. Among the technical feats were exploits that exercised extreme surgical precision in infecting only the intended target. One exploit hosted on a site related to Islam took pains not to infect two specific site users. Rather than enumerate their plain-text user names, the exploit code converted the names to MD5 hashes. Using a custom-built super computer, Kaspersky researchers quickly deciphered the first hash—84b8026b3f5e6dcfb29e82e0b0b0f386—as "unregistered," but they were unable to crack the second one.

"Our idea was, if the first hash means 'unregistered' in English, would it be possible that the second hash means 'unregistered' as well, but in Arabic?" Steube said. "So we tried to download some Arabic expansion packs for [website comment app] vBulletin, which is the forum software that was attacked here."

Shortly afterward, Steube and Schmidt cracked the hash. Blocking attacks against visitors bearing the username unregistered is an indication that attackers didn't want to infect visitors who weren't logged in. Instead, the attackers appear to have had specific users in mind.

Equation Group included six other hashes in different exploits that remain unknown at the moment. They appear to be generated by the SHA1 algorithm. They are:

0044c9bfeaac9a51e77b921e3295dcd91ce3956a

06cf1af1d018cf4b0b3e6cfffca3fbb8c4cd362e

3ef06b6fac44a2a3cbf4b8a557495f36c72c4aa6

5b1efb3dbf50e0460bc3d2ea74ed2bebf768f4f7

930d7ed2bdce9b513ebecd3a38041b709f5c2990

e9537a36a035b08121539fd5d5dcda9fb6336423

Kaspersky researchers are still seeking help in cracking those.