If you want to find malware with no AV signatures, look at no-name warez of medium popular and niche professional software, and honey-net via unpatched Windows computers on exo-DMZ unfiltered IP addresses. I saw this one sample behavioral analysis of a trojaned well-known firewall product for Mac that tries to download Google Chrome in order to clickbot... no AV signature for it. With the right APT defenses, such as a root priv esc, SIP bypass and process & file cloaking, it would be entirely possible to keep nodes pwned much longer, at the cost of 2-3 sploits... and better use such farm for a big money-maker.