It's funny how you mention polymorphism in malware. Just recently I came across a modified version of a stock exploit kit which was serving Zeus with each signature being unique. I didn't look into it too much be it seems like there were several thousand precompiled version of the executable on the server and each unique copy was only being loaded for a few hosts to evade anti-virus detection.
There is even open source software that helps evade Antiviruses. If anybody's interested in further reading, I would definitely recommend:
[1]https://www.veil-evasion.com/tutorial-veil-payload-developme...
[2]http://blog.webroot.com/2013/02/22/diy-malware-cryptor-as-a-...
[3]https://www.christophertruncer.com/veil-a-payload-generator-...