Sophos Endpoint detect cache2 folder of Thunderbird as malware

Hello Hung,

Thank you for reaching out to the Sophos Community. 

From the behavior you’re describing, it sounds like the mail application has cached part of an email that was received previously. The cached information is then being scanned by Sophos and getting picked up as potentially malicious. 

Do you know if the detections correspond with any specific navigation/re-loading of old inbox items through the mail client? 

Hi Qoosh,

I discovered one thing is that when I search or install any extensions/themes on Thunderbird, Sophos Endpoint detects malware. I also try to go to Firefox to search or install extensions/themes, everything is fine. Both products are from Mozilla.

I’m using Thunderbird version 91.2.0 (64-bit). Can you help test it?

Using virustotal.com to scan the file that Sophos Endpoint detects as malware, the result from that site is "No security vendors flagged this file as malicious"

Hello Hung,

I recommend submitting the detected file through our sample submission portal. You’ll need to include the "detection Id" that comes up when the file is detected as well. The detection ID can be supplied in the "Why do you want to send this sample" field. 
- support.sophos.com/.../filesubmission

Hello Hung,

I recommend submitting the detected file through our sample submission portal. You’ll need to include the "detection Id" that comes up when the file is detected as well. The detection ID can be supplied in the "Why do you want to send this sample" field. 
- support.sophos.com/.../filesubmission