BQTLock PyInstaller Loader start.exe Spawning BQT.exe Ransomware Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the BQTLock ransomware distribution chain, where a PyInstaller-packaged loader executable (start.exe) is used to unpack and spawn the primary BQT.exe ransomware payload. The detection monitors for process creation events where start.exe exhibits typical PyInstaller command-line artifacts (e.g., _MEIPASS) and initiates BQT.exe, which is associated with malicious activities including UAC bypass and file encryption.