Troj/Ranck-CQ is a proxy Trojan for the Windows platform.
The following registry entry is created to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Caesvrn
<path to Trojan>
Troj/Ranck-CQ listens on a randomly selected TCP port between 1025 and 9997 inclusive. A remote attacker may connect to this port in order to route internet traffic via the infected computer.
Troj/Ranck-CQ advertises its presence by encoding the number of this port in a UDP packet sent to each of several preconfigured IP addresses.