Kangaroo Ransomware is a new offering from the creator of Apocalypse ransomware.
Its basic features are similar to those of other ransomware such as Locky: encrypting files related to the affected system and displaying a ransom message on the screen. But Kangaroo does it in a way that sets it apart from the rest.
This ransomware modifies the Windows registry to display a message that looks like a legal warning before the login screen. The message – including the creator’s contact information – can be easily bypassed, allowing a user to log in to their machine.
It encrypts files and appends the message “.crypted_file” to them. For example, a file named myfile.txt becomes myfile.txt.crypted_file. Furthermore, it also attaches a text file that has a ransom message to each of the encrypted files. For example, myfile.txt.crypted_file.Intructions_Data_Recovery.txt
Kangaroo attempts to entice victims to contact the developers by displaying a screen lock that has the email address kangarooencryption@mail.ru. Victims must provide their Personal ID in order to receive the password and decryption software after paying the money.
Normally, ransomware spreads through email or software downloads. But in the case of Kangaroo, the hacker creates a remote desktop connection to the victim's computer and installs the ransomware manually.
There are methods, such as System Restore, that can be used to remove this ransomware, but it will not help in recovering your data, which can only be restored with an existing backup file. One possible reason is the lack of information about the type of encryption used by the ransomware. If you prefer to pay an exorbitant amount of money to the developers, keep in mind that success is not guaranteed. Your card details may be compromised during the payment process.
