Executive Summary
BQTLock (also known as BaqiyatLock) is a sophisticated ransomware variant characterized by its multi-stage attack chain and reliance on common messaging platforms for data exfiltration. The malware is distributed as a PyInstaller-packaged loader (start.exe) that deploys the primary ransomware payload (BQT.exe). It employs several high-level evasion techniques, including UAC bypassing via EventViewer and extensive anti-analysis checks that detect PyInstaller environments and debugging tools.
Technically, BQTLock functions as both a ransomware and an information stealer. It harvests credentials from browsers such as Chrome, Firefox, and Opera, captures desktop screenshots, and gathers extensive system telemetry before encrypting user data with a .bqtlock extension. The threat actor uses a hybrid C2 infrastructure involving hardcoded Telegram Bot API tokens, Discord webhooks, and a custom API endpoint (92.113.146[.]56), which facilitates automated victim reporting and payload distribution.