Apparently it was outsourced from a firm in hong kong. A victim emailed them and said they didn't have the $400, the hacker bitched back that the hong kong firm grossly overestimated incomes in most regions. Went on to decrypt the victim, but then said if the victim liked the software (dafuq?) They should spend a few bucks to buy them some coffee.
I never liked the coffee analogy.
I figure most people still running XP probably aren't all that wealthy, and that the targets were individuals rather than institutions.
That being said, I know the atms at my bank are running xp, because of the usb disconnection tone.