Well, there's this study from 2018: https://link.springer.com/article/10.1007/s11416-018-0319-9

Given that Priton / Wine / ... try to simulate a Windows environment, it's certainly possible. But I've never heard this happened to anyone. And the discussions on the internet seem very theoretical.

Surely it highly depends on the exact kind of malware and what it tries to do. And it doesn't really seem to happen in the wild. But I see no reason why it wouldn't theoretically work.