It has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. It has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.