Hacker News Reader

I don't know if this one was detected in the wild or not (99% chance it was), however, malware authors occasionally use Virustotal too.

There are virustotal clones that don't send back results to the vendors. This is specifically done to prevent that kind of problem.

A lot of stuff is uploaded to VirusTotal by automated systems ("in the wild") so it is often a case of "If a tree falls in a forest and no one is around to hear it, does it make a sound?"

Maybe it was only caught by honeypots and turned in from there.