No, I meant the oo2scan_7_win64.exe by Razor12911, as it lists these algorithms:
Code:
Universal Oodle stream scanner
Created by Razor12911
[0] = Unknown/Invalid
[1] = Kraken/Hydra
[2] = Mermaid/Selkie/Hydra
[3] = Leviathan/Hydra
If you scan and you see [1] appearing, it could be that you are seeing Hydra streams, not kraken.
Try extracting a single stream from the sample you are testing on using XTool verbose output and a Hex editor and attempt to precompress it with oo2reck. If it *is* a Kraken stream, it will be inflated. Otherwise, try Hydra.