The point in them re-implementing some of the public tools is so sites like totalvirius or a hash based antivirus does not pick up on what the program is. If t

The point in them re-implementing some of the public tools is so sites like totalvirius or a hash based antivirus does not pick up on what the program is. If they didn’t have a binary that looked reasonably different to those that already exist, then it would instantly get triggered. It is worth noting that there are tools to obfuscate sourcecode/bins.