MAL NoDepDNS CL STA 0969 Jul25
Detects the NoDepDNS backdoor, a Golang-based implant used by the CL-STA-0969 threat actor. It passively listens on UDP port 53 for DNS queries and executes XOR-encoded commands embedded in the IP address responses.
YARA
