Q:

Anti-virus evasion testing: using VM with AVs to test payload detection

Using a tool like veil or hyperion to evade an AV for pentesting, it's not advised to upload to virus total because it increases detection rate (and/or gets some special attentions).  My understanding is that if you upload to Virus Total, there's a good chance your payload/ its signature could end up in AV databases.  
That said, if you don't know what AV you're going to need to evade, is it appropriate to do the following: 

buy a subscription to say, the x most popular AVs
install them in a VM 
update so they have the most recent database
shut off any network connections (so it can't report back the payload)
Scan our payload

1) Would this prevent the payload from ending up in a an AV DB / getting detected? 
2) Is there a better way of doing this?  I know Virus Total allows you to check hashes but there must be other heuristics that AVs use.  
3) If not, is there a VM or tool someone has made to do this? 
Thank you. 

A:

After some research I believe I've come to an answer.  I may need to clarify my question but in a nut shell what I'm looking to do is this: I'd like to be able to test my payload against as many anti-virus engines/databases as possible.  Normally I'd do this with virus total, but I'm told that if you upload a sample it increases the likelihood that my payload will become detected.  In other words, samples uploaded to VT get some "special attention" and thus most tools discourage users from uploading.  
My solution is to scan my sample/payload with VMs containing various anti-virus softwares.  In my search I found a tool that does just this.  That is, it's an open source Virus Total which I as a user retain complete control over.  
Meet Malice.  Malice works by spinning up docker containers which contain various AVs.  Most of them are free but you can also provide product keys for AVs that have paid subscriptions.  This is exactly what I was looking for.  I can now run a command like malice scan sketchy.exe and it will scan against the default AV engines.  While not as complete as Virus total, this is definitely good enough.  Really a cool project, I hope it continues to under go active development.  
While this does answer my question, someone might know of a better solution so I'm going to wait at least a few days to accept my own answer.  
As @atdre mentioned, there are many other such tools. 
opswat.com/solutions/multi-scanning
irma.quarkslab.com/overview.html
github.com/PlagueScanner/PlagueScanner
github.com/joxeankoret/multiav
herdprotect.com 

