1. A system comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: gathering trace data for variants of a malware specimen; categorizing the trace data into malicious characteristics and non-malicious characteristics; building malware detectors that distinguish between the malicious characteristics and the non-malicious characteristics; determining a rating for each of the malware detectors, the rating based on an amount of the malicious characteristics detected and an amount of the non-malicious characteristics incorrectly detected; selecting, for mutation, a malware detector having a rating above a predetermined threshold; and mutating the selected malware detector having the rating above the predetermined threshold.