Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like:
- php shells
- java shells
You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with:
If you are new to Metasploit, there is an official tutorial that also includes how to use the HTTP shells.
As for bots, there is a famous IRC bot from "feelcomz", that has code in many places online. A Google search will get you the code. There are also good bot simulators.
Many Snort rules include the reference to the malware they detect, which allows you to see the malware behavior and to hunt down specific types. Or, you can set up a honeypot and collect your own live malware to analyze, which is how researchers build their own malware databases.
That list should keep you busy for a while...