1. A system, comprising: a processor configured to: set a first guest clock to a first value in a first virtual machine instance and execute a first malware sample in the first virtual machine instance; set a second guest clock value to the first value in a second virtual machine instance and execute a second malware sample in the second virtual machine instance; and perform a comparison of attempted external contacts generated by executing each of the respective first and second malware samples, and determine that the first malware sample and the second malware sample are the same, based at least in part by determining that a threshold number of duplicate attempted external contacts were generated by both the first malware sample and the second malware sample; and a memory coupled to the processor and configured to provide the processor with instructions.