BQTLock Anti-Debug and PyInstaller Sandbox Evasion Check Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the execution of BQTLock ransomware loader components (start.exe or BQT.exe) that contain embedded PyInstaller environment artifacts. The rule monitors for processes that incorporate specific environment variables associated with PyInstaller-packaged binaries, which are often used by this malware to detect debugger presence and sandbox environments before proceeding with its primary malicious functionality.