BQTLock start.exe spawning BQT.exe with WMI-based sandbox/VM checks

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the BQTLock ransomware loader (start.exe) spawning the primary payload (BQT.exe), which subsequently executes WMIC to perform hardware, virtualization, and sandbox environment enumeration, a technique commonly used for evasion.