[sb23]

Seems like if it were feasible it would already be being used by malware authors. Why would they not already be using cipher.exe?

[dogma1138]

Some do, at least according to Sophos https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...

And why would not re-inventing the wheel be a problem that malware developers have solved? ;)