Kangaroo Ransomware Detection

This YARA rule detects the Kangaroo ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes (hex patterns) that are characteristic of the Kangaroo ransomware's code for encrypting files, locating files on the system, and enumerating resources.