The Kangaroo ransomware is the latest ransomware from the developer behind the Apocalypse Ransomware, Fabiansomware, and Esmeralda.
Also, due to the ransomware terminating the Explorer processes when started and preventing the launching of Task Manager, it essentially locks a user out of Windows until they pay the ransom or remove the infection. Though the screenlocker can be disabled in Safe Mode or by pressing the ALT+F4 keyboard combination, for many casual computer users this would essentially prevent them from using their computer.
Following successful infiltration, Kangaroo encrypts files and appends their names with the “.crypted_file” extension (for example, “sample.jpg” becomes “sample.jpg.crypted_file”). Once files are encrypted, Kangaroo opens a pop-up message and creates identical text files beside each encrypted file. The text file names are associated with the encrypted files (for example, “sample.jpg.crypted_file.Instructions_Data_Recovery.txt”). The pop-up message and text files contain an identical ransom-demand message.
Unlike most other ransomware infections, this family is not spread through exploit kits, cracks, compromised sites, or Trojans, but instead by the developer manually hacking into computers using Remote Desktop. When the dev hacks into a computer and executes the ransomware, a screen will be shown that contains the victim’s unique ID and their encryption key.
When the developer clicks on Copy and Continue, the information will be copied into the Windows clipboard so that developer can save it. The ransomware will then begin to encrypt the computer’s files and will append the .crypted_file extension to an encrypted file’s name. This ransomware also performs the strange practice of creating an individual ransom note for every file that is encrypted. These ransom notes will be in the format of filename.Instructions_Data_Recovery.txt. For example, test.jpg.Instructions_Data_Recovery.txt.
When finished Kangaroo will display a lock screen that displays a fake screen implying that there is a critical problem with the computer and that the data was encrypted. It then provides instructions on how to contact the developer at firstname.lastname@example.org to restore the data.
This ransomware will also configure the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon “LegalNoticeText” registry value so that it shows a legal notice that a user must read before they are shown the Windows login prompt. This guarantees that a victim, or a computer’s administrator, will see the ransom note the next time they login.
At this time, there is no way to decrypt the encrypted files, as I have always cautioned the readers to keep a good Anti-Virus Total security program such Max Total Security to prevent and recover data once attacked by Malware.