First thing a malware would do is to replace top/ps and related utilities, to mask itself. Or directly replace kernel calls. You will not notice by just checking running processes

So why would this need docker at all?