A large portion of AV malware detection is by blacklist from previously encountered samples then uses signature scanning to catch it. So if someone creates a b

A large portion of AV malware detection is by blacklist from previously encountered samples then uses signature scanning to catch it. So if someone creates a brand new malware it is generally undetected unless they trip other detectors like in a sandbox or memory manipulation, or remote call/exec.