its Typical that the Virus Writer will use their own service, there is criminal virustotal-clones that run many AV in VM and return the Results, because virustotal will share all binaries, anything upload in Virustotal will be detteceted shortly if it is not.

Isn’t it still that when signatures are added at some point it turns out that the malware code has been uploaded months before, or did that change?