Hacker News Reader

I don't know if this one was detected in the wild or not (99% chance it was), however, malware authors occasionally use Virustotal too.

There are virustotal clones that don't send back results to the vendors. This is specifically done to prevent that kind of problem.