Malware which simply doesn't do anything for the first few weeks, or even hours, is hard to detect by running it in a VM box. Some "advanced persistent threats" are like that.
Like most long cat-and-mouse games, modern malware families all use a combination of many different tricks and anti-sandbox/analysis techniques. The sandboxes play whack-a-mole at the same rate as malware keeps adding more moles.
It's obviously a cat & mouse game.
It's called metamorphism - the entire code of the virus is continuously changed. They're incredibly complex pieces of code; in at least one case, 95% of the code was devoted to the metamorphic engine.
Note the difference with polymorphism, where only the decryption routine[s] change.
Two notable viruses have been Zmist and Simile.