For how they built it, see https://securelist.com/blog/69595/challenging-coinvault-its-...
So they were able to dump a memory segment into a hex editor, and locate references to RijndaelManaged. So what?
In the screenshot, I still see:
Server.GetKey().Key
So how did they convince the malicious server to cough up the token for free?Reading between the lines, the police located the server, served a subpoena to the hosting company, and took possession of the server. They then turned it over to Kaspersky who created the site based on the keys on that server.
The screen dumps are just showing how they figured out the decryption routine - the private key alone doesn't do you much good if you don't know the algorithm used.