Question: I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can take a look?

Answer: 
I doubt you'll find ransomware source code floating around in the general public. I'd guess there is code out *there somewhere* but I wouldn't risk visiting shady sites on the "Darknet" (I really hate that term).

(Un)fortunately, ransomware is not very complex. For a university project, simply encrypting and replacing files in ~/Documents is probably good enough. The trick is making the decryption key only obtainable through you. 

Encryption:

1. Generate Symmetric Key **K**
2. Encrypt all files in ~/Documents with **K**
3. Send **K** to Server
4. Erase all traces of **K**

Decryption:

1. Obtain **K** from server.
2. Decrypt files with **K**

I know that notorious ransomware use Asymmetric Encryption, but it actually isn't necessary at all. For example, improperly implemented RSA by [CryptoDefense](http://blog.emsisoft.com/2014/04/04/cryptodefense-the-story-of-insecure-ransomware-keys-and-self-serving-bloggers/) actually made it **easier** to write automated decryption tools, because they didn't realize that a Windows Crypto API keeps local copies of generated RSA Private Keys. Putting blind faith in a crypto system won't make it secure. What's important is that the decryption key is not recoverable on the system. Whether or not this is done by zero'ing memory or encrypting **K** with an RSA Public Key really does not matter.
No. There is not and I am quite sure there will never be: imagine nuclear weapons are available to buy in the shop.

The spirit of the Open Source community is luckily investing positive efforts to develop tools that protect users ranging from anti viruses such as [ClamAV](http://www.clamav.net/index.html) to web vulnerability scanners such as [Grabber](http://rgaucher.info/beta/grabber/), passing by tools that are rather intended to assess users' systems such as [those](http://tools.kali.org/tools-listing) you can find in Kali Linux used for pentesting (of course, you can always use the knife to kill someone instead).

But it is true that there are some open source *nefarious* tools such as [ZombieBrowserPack](https://github.com/Z6543/ZombieBrowserPack) which is a plugin can be manipulated remotely to steal authentication credentials and even bypass two-factor authentication mechanisms such as the ones implemented by Yahoo and Google, or simply hijack your Facebook account and much more. However, this must not lead to misunderstanding: this plugin is developed by [Zoltan Balazs](https://nl.linkedin.com/in/zbalazs) as a POC for academic purposes as similar other tools in the same context: virus code is present freely on Internet but it is intended for academic purposes and it can not harm because any malware which code is released its life is ended as anti-virus companies conceive a protection against it.