BQTLock Anti-Analysis: PyInstaller Env Check and Short-Lived Process Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of short-lived processes (under 5 seconds) named 'start.exe' or 'BQT.exe' that contain environment variables or flags indicative of PyInstaller. This behavior is often associated with malware attempting to evade analysis or sandbox environments by executing and terminating quickly.