I've been writing malware for professional security tests for more than 20 years. Evasion of AV detection is one of the common requirements of our customers. The approach depends on which scanning mechanism shall be evaded.
Pattern-based detection is very simple in the AV environment. This is like a regular expression which tries to identify a common part of the specific malware. If the malware gets changed regarding this identification signature the detection won't work anymore. Changing code fragments (e.g. strings, internal names) or code block location in the binary are done quickly and will succeed.
A heuristic-based detection does something similar but not with code blocks but with “actions“. An action would be opening a file, writing a string and closing the file again. A suspicious sequence on a Windows file system might be creating a file and adding the hidden flag immediately to it. Most AV products declare this malicious. And in most cases it is (how many legitimate applications do this?). But if you wait a few seconds between these two tasks or do something else in between (like opening another file in the meanwhile) the heuristic will miss the original connection between the initial tasks.
Splitting the tasks into multiple binaries running like multi-threading instances might cause a similar effect. This is because AV software can't correlate that many actions from multiple processes. The challenge might be that you have to deploy all your binaries on the target host to establish your framework. But this might raise some flags during the heuristical analysis (multiple downloads, downloading another binary after execution or extracting multiple executables from within a single binary). I'm usually downloading additional parts and abandon the original “downloader“. This works well, generates small binaries and is efficient. AV detection works rather bad with ultra small and simple files.
I've never had a case where circumventing AV detection was not possible. It might just take more time than usual. This might be the reason why some people call AV snake oil.