A computer implemented method, comprising: receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; performing, for each of the plurality of samples, automated malware analysis and generate the log files, whereby a log file for each sample comprises one or more lines based on the automated malware analysis; processing the log files to extract features associated with malware, wherein each of the extracted features corresponds to a line or a sub-line in one or more of the log files determined to be an artifact associated with malware; clustering the plurality of samples based on the extracted features, wherein clustering the plurality of samples based on the extracted features further comprises: selecting one or more of the extracted features and assigning values to each of the selected features, wherein selecting one or more of the extracted features includes performing a pre-filtering operation to select the extracted features for clustering based on a determination that a number of malware samples associated with the line or the sub-line in the one or more of the log files satisfy a feature threshold; collecting the assigned values in an array for each of the plurality of samples; comparing the assigned values of the array between two of the plurality of samples; and calculating a distance between the two samples, wherein the samples within a defined threshold of distance are clustered; performing an action based on an output of clustering the plurality of samples based on the extracted features, wherein the action based on the output of clustering the plurality of samples based on the extracted features further comprises validating the output of clustering the plurality of samples based on the extracted features based on tags to identify previously identified malware groups, wherein a tag is a set of conditions that collectively indicate a known threat. receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; performing, for each of the plurality of samples, automated malware analysis and generate the log files, whereby a log file for each sample comprises one or more lines based on the automated malware analysis; processing the log files to extract features associated with malware, wherein each of the extracted features corresponds to a line or a sub-line in one or more of the log files determined to be an artifact associated with malware; clustering the plurality of samples based on the extracted features, wherein clustering the plurality of samples based on the extracted features further comprises: selecting one or more of the extracted features and assigning values to each of the selected features, wherein selecting one or more of the extracted features includes performing a pre-filtering operation to select the extracted features for clustering based on a determination that a number of malware samples associated with the line or the sub-line in the one or more of the log files satisfy a feature threshold; collecting the assigned values in an array for each of the plurality of samples; comparing the assigned values of the array between two of the plurality of samples; and calculating a distance between the two samples, wherein the samples within a defined threshold of distance are clustered; selecting one or more of the extracted features and assigning values to each of the selected features, wherein selecting one or more of the extracted features includes performing a pre-filtering operation to select the extracted features for clustering based on a determination that a number of malware samples associated with the line or the sub-line in the one or more of the log files satisfy a feature threshold; collecting the assigned values in an array for each of the plurality of samples; comparing the assigned values of the array between two of the plurality of samples; and calculating a distance between the two samples, wherein the samples within a defined threshold of distance are clustered; performing an action based on an output of clustering the plurality of samples based on the extracted features, wherein the action based on the output of clustering the plurality of samples based on the extracted features further comprises validating the output of clustering the plurality of samples based on the extracted features based on tags to identify previously identified malware groups, wherein a tag is a set of conditions that collectively indicate a known threat.