In addition, at least 16 people, including several children, are injured and in hospital. Three are in critical condition.
The pistol-wielding attacker, identified by Munich Police Chief Hubertus Andrae as a citizen of both Germany and Iran, was later found dead of a suspected self-inflicted gunshot wound. German news magazine Focus said the man shot himself in the head.
Thousands of people had been crowding the streets and squares in Munich's city centre on Friday for a beer festival when occured.
Authorities said it was too early to say whether what happened in Munich is a terrorist attack. They said they had no immediate evidence of an extreme Islamist motive. Still, while there was no immediate claim of responsibility for the attack, supporters of the Islamic State celebrated on social media.
"The Islamic state is expanding in Europe," read one tweet.
German Chancellor Angela Merkel is scheduled to meet her chief of staff, Peter Altmaier, Interior Minister Thomas de Maiziere and a host of intelligence officials on Saturday to review the incident.
Police thought there were 3 suspects
Police, citing witnesses, initially said they were looking for up to three suspects and were treating the incident as a suspected terrorist attack.
But authorities told a news conference early on Saturday that they believe the shooter staged the attack alone, when he opened fire on a fast food restaurant before moving to the mall.
Police chief Andrae said authorities didn't see similarities with the attack in southern Germany last Monday when an axe-wielding 17-year-old asylum-seeker killed five people. That incident was claimed by the Islamic State terror group.
Andrae said it was premature to say whether the Friday incident was a terrorist attack or the work of a deranged person. The gunman, whose body was found on a side street near the mall, was not previously known to the police, Andrae said.
German radio station Bayerischer Rundfunk said the shooter had a red backpack similar to the one used by a gunman seen at a McDonald's restaurant where the attack reportedly began.
A police spokesman initially said up to three gunmen were on the run after the shooting. Two individuals were seen driving away quickly from the scene, but they were later cleared of any wrongdoing, the police chief said.
After the shooting, Germany's third largest city went into lockdown with transport halted and highways sealed off. The Bavarian capital was also placed under a state of emergency as police hunted for more possible.
Equipped with night vision equipment and dogs, police raided an apartment in the Munich neighbourhood of Maxvorstadt early on Saturday. A police spokesman declined to comment on whether the house was the gunman's .
In addition, even though the gunman killed himself, police didn't release his name, citing privacy concerns.
Munich shooting is a 'terrorist attack': France's Hollande
While Germany remained circumspect about the nature of the attack, French President Francois Hollande declared it was a "disgusting terrorist attack" aimed at striking fear in Germany, after France was targeted a week earlier.
"The terrorist attack that struck Munich killing many people is a disgusting act that aims to foment fear in Germany after other European countries," Hollande said in a statement.
"Germany will resist, it can count on France's friendship and cooperation," he said, adding that he would speak with German Chancellor Angela Merkel on Saturday morning.
No apparent link with Islamic State so far
In the meanwhile, US intelligence officials, speaking on the condition of anonymity, said initial reports from their German counterparts indicated no apparent link between the shooter and the Islamic State or any other militant groups.
The two previous attacks of the past 8 days, in France and Germany, were claimed by the Islamic State.
The mall that was hit is next to the stadium where a Palestinian militant group called Black September took 11 Israeli athletes hostage and then killed them during the 1972 Olympic Games.
Friday was also the fifth anniversary of the massacre in Norway by far-right militant Anders Behring Breivik, who killed 77 people.