Persistant and undelete-able cookie

Browser Support
1

This cookie is named “static.trac

50%20PM
50%20PM674×701 38.3 KB
kivation.com”
Spelling of cookie was corrected 06-10-19

It is virtually unknown on the web and immune from deletion. I have tried to block it in Brave using the blocking procedure and it keeps reappearing. I cannot find it in any of my system files although it resides inside my cache. It appears after closing my browser and reopening it. A screen shot is enclosed. Sorry…I cannot cut and paste that.

Version 0.65.118 Chromium: 75.0.3770.80 (Official Build) (64-bit) operating on Mac OS Mojave 10.14.5

2

@Fistfullofknuckles,
Can you try and share the image again? I can’t see it on my end.

3

Image uploaded and spelling of cookie corrected.

4

To confirm – were you to remove this cookie from within Brave, close and relaunch the browser, the cookie would reappear immediately?

5

That is correct. Cookie reappears even when blocked and permissions changed to NOT ALLOW… Another thing that I noticed is that the browser Flash settings across sites for this cookie keeps changing back to Allow from Block. This is worrisome behavior. Added 1:58 PST
Further investigation using Firefox turned up a reference to this file at
https://www.hybrid-analysis.com/sample/35362fe727d9049fb9b9fc476cc6a1e60d71ec53a189a851c31158d95fb4e8a1?environmentId=120

6

@Fistfullofknuckles,

This is intended behavior, as Flash is allowed only on a per-site basis because of the potential security risks associated with it.

Looking into this invincible cookie issue still – will let you know what I find out.

7

Any info for me yet?

8

@Fistfullofknuckles,
Something (outside of Brave) is putting that cookie there – just a matter of finding out what it is. We can confirm this much at least by performing a simple test; try downloading one of our other Brave builds and see if you get the cookie in that version as well.

Resources:

Note that downloading, installing and using any of these will not overwrite or interfere with the Release version you have currently installed. Download and launch one of the following and check your cookies to see if this same one appears in the newly download build.

Let me know what you find out.

9

Pass on the download… If you investigate the link that I sent you, it will be plain to see that this file generates it’s own mutant files and other behaviors.

10

Hey there. I’m having trouble following the conversation. Could you explain exactly what’s happening and why you think that’s the case?

11

Hi There…I have a cookie that keeps re-appearing no matter if I block it or delete it in Brave. The name of the cookie is static.trackivation.com It does not show up in Firefox or any searches of my files, nor is it recognized by my AV Sophos Home for Mac. It is persistent and reloads itself after I delete it using Brave. It spawns new processes and mutants, and places a new copy of itself every time there is a call to connect. I have given the team at Brave, the only address and site where I have found any information about this malware but I am unable to furnish any sample’s as the file itself seems to be nonexistent by that name. Your team seems reluctant or unwilling to get any information there. Please read the link that I furnished to find out what this malware is capable of and how it behaves? Sophos has been advised and is on the case. Please help me Obi Wan. Thankx . Randy

12

I understand that there’s a cookie you see every time you open Brave. It sounds like you think that it’s related to a piece of malware on your system?

13

Yes…Please see umpteen previous posts for info. Deductive thinking would lead one to that conclusion. What do you think about it?

14

I don’t know what’s happening on your machine. I’m not seeing what you’re seeing and I don’t have the context you have. I’m asking for more information because I haven’t been able to follow your previous explanations. Please understand that I’ve read this whole thread and I’m asking for clarification because I haven’t been able to piece together a concrete narrative from your existing posts.

2 Likes
15

This topic was automatically closed after 30 days. New replies are no longer allowed.