Question: I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can take a look?

Answer: 
I doubt you'll find ransomware source code floating around in the general public. I'd guess there is code out *there somewhere* but I wouldn't risk visiting shady sites on the "Darknet" (I really hate that term).

(Un)fortunately, ransomware is not very complex. For a university project, simply encrypting and replacing files in ~/Documents is probably good enough. The trick is making the decryption key only obtainable through you. 

Encryption:

1. Generate Symmetric Key **K**
2. Encrypt all files in ~/Documents with **K**
3. Send **K** to Server
4. Erase all traces of **K**

Decryption:

1. Obtain **K** from server.
2. Decrypt files with **K**

I know that notorious ransomware use Asymmetric Encryption, but it actually isn't necessary at all. For example, improperly implemented RSA by [CryptoDefense](http://blog.emsisoft.com/2014/04/04/cryptodefense-the-story-of-insecure-ransomware-keys-and-self-serving-bloggers/) actually made it **easier** to write automated decryption tools, because they didn't realize that a Windows Crypto API keeps local copies of generated RSA Private Keys. Putting blind faith in a crypto system won't make it secure. What's important is that the decryption key is not recoverable on the system. Whether or not this is done by zero'ing memory or encrypting **K** with an RSA Public Key really does not matter.
"[The Zoo](https://github.com/ytisf/theZoo)" is a good source of malware for research, including some ransomware. [This](https://github.com/ytisf/theZoo/tree/master/malwares/Source/Original/Ransomware.Jigsaw), for example, is ransomware:

Modern ransomware does not typically use just a symmetric key or operate via the mode described in some of the other answers. A method of operation more closely related to "real world" ransomware looks like this:

* Generate a unique asymmetric key pair on the ransomware server
* Send the public key to the victim machine for use with ransomware client (already lying in wait on victim machine)
* For each file in list of files to encrypt:
* ... generate random symmetric key (e.g., AES key)
* ... encrypt file with random symmetric key
* ... encrypt symmetric key with asymmetric public key
* ... replace file with symmetric-encrypted file concatenated with public-key-encrypted symmetric key

In this manner, each encrypted file has its own symmetric key encrypted with the unique public-key. Thus the only possibility of recovery is by purchasing the private key, which only exists on the ransomware server.