[koolba]

How does that work in practice? Do the decryption keys get stored in the block chain as well or out of band?

[pas]

out-of-band, probably sent via email or managed through the "malware app" itself.