Virustotal has been well known for a while now as a honeypot for catching new strains of malware and zero-days. Chances are it was uploaded by an unknowing "customer" of a malware author.
It seems VirusTotal is a tool for running 70 anti-virus products at once against the same file. How can VirusTotal catch freshly developed malwares? How would VirusTotal even suspect that an uploaded file was fresh malware? That doesn't make sense to me.
Lets assume you know a threat actor always uses the same variable names during heap sprays, you can discover new malware from this threat actor with a Yara rule to look for this pattern.