PAGES
← all tools
◆ Password & Credential Cracking

oclgausscrack

open-source

oclGaussCrack is an OpenCL-accelerated tool that cracks the verification hash of the encrypted payload of the Gauss Virus.

source ↗ rss ↗ What is a cyber toolchain?

Summary

oclgausscrack is an open-source command-line cracker, licensed under GPLv2, built to break the verification hash of the Gauss virus's encrypted payload using OpenCL to accelerate the underlying 10k-round MD5 loop on GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference., with multi-GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support and resume built in. It reads candidate input from stdin, hashes it against a fixed salt, and checks matches on the GPU, so it is aimed at malware researchers and reverse engineers working on that specific Gauss payload rather than general password auditors, and it sits in the same technical territory as GPU hash-cracking tools like oclHashcat, whose optimizations its README says it reuses. First committed in 2016 with a single contributor and no commits in the past year, it is effectively dormant.

oclGaussCrack is an OpenCL-accelerated tool that cracks the verification hash of the encrypted payload of the Gauss Virus.

How oclgausscrack helps

What candidate value unlocks the Gauss payload's encrypted section?

streams candidate strings from stdin, appends the fixed salt, runs the CPU-then-GPU MD5 pipeline against the known verification hash, and reports the original plaintext for any candidate whose GID matches

Is a wordlist worth feeding to the cracker at all, given the strings it likely contains?

filters a dictionary by a Unicode threshold before the run, so non-matching or wrongly-encoded entries can be dropped before spending GPU cycles on them

Could the key be a non-ASCII string the malware authors encoded a specific way?

includes a step to generate UTF-16LE test input, letting candidates be tested in the encoding Gauss itself may have used rather than plain ASCII

Can several dictionaries be tried as one combined candidate set instead of running each separately?

combines multiple dictionaries into a single stream that is then run through the same salt-and-hash pipeline in one pass

Will a long-running crack survive an interrupted session or a multi-GPU rig?

keeps resume state and spreads the workload across multiple GPUs of the same type, so an interrupted search can continue rather than restart from the first candidate

Can the result be trusted against the actual Kaspersky-published hash before committing a full run?

ships the official Kaspersky test vector and a test-mode target hash so a run can be verified against a known match before pointing it at the real unknown key

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities

Built from oclgausscrack's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 3 capabilities
Dictionary manipulation shipped Filter dictionaries by Unicode thresholds and combine multiple dictionaries for use in cracking operations. 2 other sources

example

  • Filter dictionary by Unicode threshold ./gaussFilter64.bin PROGRAMFILES.dict > PROGRAMFILES_filtered.dict
  • Combine dictionaries and crack hash ./gaussCombinator64.bin GetEnvironmentVariableW.dict PROGRAMFILES_filtered.dict | ./gaussCrack64.bin
Hash cracking with custom inputs shipped Crack hashes using test vector inputs or generate test input files for verification. 2 other sources

example

  • Crack hash using test vector input ./oclGaussCrack64.bin < test.txt
  • Generate UTF-16LE test input file echo -n "C:\Documents and Settings\john\Local Settings\Application Data\Google\Chrome\Application~dir1" | iconv -f utf8 -t utf16le > test.txt
GPU-accelerated payload verification documented Perform GPU-accelerated cracking for the Gauss Virus encrypted payload verification hash using OpenCL and iterated MD5. 1 other source

docs

  • GPU-accelerated cracker for the Gauss Virus encrypted payload verification hash using OpenCL and iterated MD5.

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for oclgausscrack, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail oclgausscrack puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Nov 23, 2017 · watching since Jun 24, 2026

Project health

Issue, contributor and maintainer activity in jsteube/oclGaussCrack, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

  1. Contributors 0 ±0 vs prior 12 months
  2. Maintainers 0 +0 joined · −0 left, last 12 months
  3. Bus factor 0 committers behind half the commits
  4. Community-filed not measured of issues opened, last 12 months
  5. Median time to close not measured issues closed, last 12 months
  6. Open backlog 1 of 2 issues ever filed
  1. Issues opened / month 0 · 0 communitymaintainers
  2. Open backlog 1
  3. Contributors / month 0
  4. Commits / month 0
  5. Stars 20
Issue themes, last 12 months not measured

Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Tracked by Cyber Toolchain Choose a badge style and copy the code →
compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback