Hacker News Reader

I can't tell from the write-up: did they find this in-use/in the wild somewhere, or does it come from a VirusTotal submission?

VT has first submission for analysis in mid-august and 22/55 vendors convicting. from the comments, it seems like the story broke here in may: