BQTLock start.exe PyInstaller Loader Spawning BQT.exe Ransomware Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a suspicious execution chain where a PyInstaller-compiled loader named 'start.exe' spawns 'BQT.exe', which is the identified payload for the BQTLock (BaqiyatLock) ransomware. The rule monitors for process launch events where these specific filenames appear in a parent-child process relationship.