Personally being ransomware I would think a bandits mask (like the firefox private browsing icon) with a $ (or Bit) Coin icon.