[dogma1138]

Some do, at least according to Sophos https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...

And why would not re-inventing the wheel be a problem that malware developers have solved? ;)