I recently saw, having nothing at all to do with crypto currency, a specific virus type that can operate inside and outside of a virtual machine. Now this particular think doesn't really apply here because it encourages the people to download app reconstructed virtual machine image, and then it outside file allows that virtual disk to be opened even while the emulator is not operating.