Crypters usually depending on if its scantime, and runtime have different methodologies they use for encryption, but generally runtime which is what seems to matter most in terms of longevity use whats called a RunPE alongside the obfuscation of the crypter, this is what you know as the "Stub", when a runPE is detected, or the coding methods used are identified by antivirus vendors as malicious the instructions are added to antivirus database definitions, so when av's scan a file, they have a record of whats "found", its an endless game of cat, and mouse. the best thing for a crypters longevity is finding one thats good at preventing reverse engineering alongside a well coded runpe.
]
