The MO a long time ago was to test it on multiple AV's until it passed on enough that were widely-deployed or used by the target. Those AV's were disconnected f

The MO a long time ago was to test it on multiple AV's until it passed on enough that were widely-deployed or used by the target. Those AV's were disconnected from the network where they couldn't send the samples back. There was a risk they'd keep something to send when networking came back on. Although not a malware developer, my recommendation was installing the software in a VM or something, updating to current sigs, cutting off networking, testing sample till it passes, and delete the VM. Then, restart the process with clean VM or (more likely) from snapshot. I'm not up-to-date on what they're doing these days, though.