Maybe, the signature of the tool is already entered in the antivirus database. therefore he is detected by the antivirus

https://reverseengineering.stackexchange.com/questions/16955/bypassing-av-signature-with-hex-editing 

Im learning too, and i have a reference. You can change dynamic to static, you can header, metadata, encode your code

If you want to bypass AV, you can encode the program, If you want to be more powerful, you have to understand the ins and outs of the target OS, I assume Windows, if you understand the Windows Registry then you can make this malware powerful, for example you can stop the task manager, hide file processes while running, make the program becomes difficult to remove

If you want e books reverse engineering, you can access here https://forum.seccodeid.com/d/reverse-engering-guides detail and more

What techniques have you used? 

🔥🔥🔥