RevStealer Polygon Smart-Contract eth_call C2 Failover Query

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects RevStealer malware attempting to use blockchain infrastructure for C2 communication or failover. The rules identify specific 'eth_call' JSON-RPC method calls to Polygon smart contracts containing hardcoded indicators, as well as TLS connections to known public RPC providers used as fallback C2 infrastructure.