Is the ransomware looking for a debugger process or simply whether the host has the program installed? If it's the latter, wouldn't an easy way to defeat (some) ransomware be by installing OllyDbg?

Is there a way to fake a virtual environment to defeat what they are looking for?