Ransomware software warning while downloading Code Composer Studio

Hello,

We have had issues with false positive reports from Sophos in the past. 

On the Sophos website they refer to another service where you can test a file if you think it is a false positive and that site reports back no issues:

https://www.virustotal.com/gui/file/fe3dbffa233c71c71c3f882167334a8719d45a44ce747b9684af92565ffbbb97

On Sophos website for cases like this they get the customer to add an exclusion, that has to be done by the customer and is not something we can help with.

There are some theories why CCS is flagged: 

• The CCS GUI is Java based and Sophos does not seem to like Java
• During installation, we will extract and run executables for installing components. 

We currently recommend for customers to add an exclusion.

Thanks

ki

Sophos CryptoGuard scans for program file access behaviour that includes accessing multiple files simultaneously and creation of encrypted files.   Accesses such as these trigger CryptoGuard to flag for potential RansomWare.  

We have performed an initial analysis of the installer and have identified that there are normal install-log related accesses that could be triggering CryptoGuard.   We are reviewing whether we can get any further insights into this detection.   Sophos recommends to run a Full scan after a detection to identify if this is a valid detection or not and based on that add an exclusion. 

https://docs.sophos.com/central/Customer/help/en-us/ManageYourProducts/Overview/GlobalSettings/GlobalExclusions/RansomwareExclusions/index.html

Feel free to post your full scan results, this could be helpful for us to get further insights into the exact trigger for the detection.