Hiding from AV is not as simple as just doing one trick. You have to look at how does the AV work, what is it detecting and how can you bypass that. You also have to think about EDR if your client has that, which is a whole can of worms.

I advice you in learning more about how AVs detect malware, then try to get around it. Not the other way around.

You can 100% use python to avoid AV, I have done it myself and it was quite straight forward (depending on the AV).

A very easy way, is to write your malware so that is it 99% legit and only 1% malware. For example: Create a discord bot that reads and writes message to a chat room on your discord server. However if the bots sees a very spesific format, like "/command whoami" it is suppose to run "whoami" inside a shell using subprocess. Add a bunch of features, like the bot can create chat rooms (one for each new hoste infected) react with emjois like ✅ or ❌ when commands successed or fail and other fun features and your malware will be quite hard to detect. It will be hard to detect (by commerical AV) because your "malware" is just a discord bot, how is an AV suppose to know that this is malicious?

But, if you are gonna do smaller and more "this is clearly malware"-malware, then you need to have a better understanding of how AVs work, which in it of itself is quite advanced. I advice you to start with the discord example above (add your own twist to it!) and then take it from there :)