I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways.
Either the password is included in the program and set prior to the attack in which case the password can be retrieved by the victim.
Or the password is sent back to one of the attacker's servers and the password in that case might be found in a log on the victim's computer or network equipment on the way and also making the attacker traceable.
In both cases the attacker risks that the victim can get the password without paying. Do they have another way of getting the password that is more secure or do they not care if some victims get away?