Malware Tracker [static + dynamic analysis]

Decode the Joy Trojan, also known as Ixeshe or RC4 Dyncalc for the use of 2 domain names used to calculate the actual IP address. The data normally begins with strings like 'Fyoj`U','6YmV|"', 'yb\x13j[' and others. Sample:
46796f6a6055f39b79f6cccf8daf1d49395014596277a51bf92fef68677b7b5411e52fb19cbebef94f48f5db7078cd6ba31a22f586d0cb9d42dc3b18312f6ff0ca5e68f490e51f857a88cf17f1cfc59acf

Hex data: