BQTLock Screenshot Capture and System Recon with Telegram Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects the execution of system information discovery utilities (systeminfo, ipconfig, whoami, net) by specific process names (BQT.exe or start.exe), followed by a DNS request to api.telegram.org within a 30-minute window. This behavior is indicative of malware performing reconnaissance and using Telegram for command and control or data exfiltration.