[Update 13.05.17, 12:26]
After registering „iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com“ the spread of the ransomware has stopped.
What a hit by MalwareTech O_o
„Earlier today, a massive ransomware campaign hit computer systems of hundreds of private companies and public organizations across the globe […]“ – TheHackerNews
The websites of the „Aachener Zeitung GmbH“ are offering a mixture of free and payed articles hidden by paywall at http://www.aachener-zeitung.de/zva/pc/. The websites use AESUtil and CryptoJS to hide articles.
The provider leaks sensitive data like password, IV and salt which are used for encryption and can be used to decrypt the articles with
decrypt = aesUtil.decrypt(salt, iv, passPhrase, cipherText);
This issue does not leak any personal data of (registered) users.
Update @ https://github.com/ol3k/azweb_decrypt