Symmi

Symmi, also referred to as MewsSpy and Graftor, is a Windows malware family notable for its domain generation algorithm used for command-and-control discovery. Samples documented from late 2014 through early 2015 used a configurable DGA whose parameters were stored as XOR-obfuscated strings. The algorithm seeded an inlined msvcrt-style pseudo-random number generator from the current date and a hardcoded constant, rotated domain sets on a 16-day cycle, and generated 64 candidate domains per cycle under a dynamic DNS suffix. The generated labels alternated vowels and consonants to produce somewhat pronounceable names, and implementation flaws excluded some characters from ever being selected.

Observed behavior shows Symmi aggressively attempting DNS resolution of many generated domains in rapid succession. When all generated domains resolve to NXDOMAIN, the malware waits briefly and restarts the process; when a command-and-control site is unreachable for other reasons, it waits longer before retrying. This behavior indicates automated command-and-control rendezvous through DGA-generated infrastructure and supports classification as a backdoor-oriented malware family with reconnaissance-like network discovery of active control nodes.

Symmi has also appeared in infrastructure clustering alongside other criminal malware operations, including domains associated with Bedep, Kazy, and the Chir mail worm. High-confidence reporting links some of this surrounding infrastructure to activity connected with the Angler exploit kit ecosystem, although direct attribution of Symmi itself to a specific threat actor is not established from the available facts. The available evidence supports Symmi as a Windows malware family using DGA-based command-and-control discovery, but does not support stronger conclusions about payload objectives such as credential theft or data exfiltration.