Luckily at least some malware authors suck at cryptography, too. Generate a random symmetric key, encrypt all files with this key, encrypt the symmetric key with an asymmetric public key included in the malware. Game over. At least until someone manages to obtain the private key.