REVSTEALER EtherHiding - eth_call to Polygon C2 dead-drop contract

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•2

This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.