Ransomware is a new form of malware that is plaguing an impressive number of victims, by applying a very effective paradigm of attack: to block data or computers and require a ransom to the victim for restoring the functionality of the infected machine. Different families and variants of this malware arose in a few years, rapidly diffusing in the wild and quickly increasing the robustness of the attack procedures. In this paper we discuss the most peculiar characteristics of this kind of malware, that we extracted from 76 samples.