A body found near the scene was that of the shooter and he appeared to have acted alone, officials said.
Witnesses had reported seeing three men with firearms near the Olympia Einkaufszentrum mall, but police said on Twitter that "as part of our manhunt we found a person who had killed himself the person is likely to have been the attacker who, according to the current state of the investigation, acted alone."
After gunfire broke out at the mall, one of Munich's largest, the city sent a smartphone alert declaring an "emergency situation" and telling people to stay indoors, while all rail, subway and trolley service was halted in the city.
It was the third major act of violence against civilians in Western Europe in eight days. The previous attacks, in the French resort city of Nice and on a train in Bavaria, were claimed by the Islamic State group.
More From This Section
The attack started shortly before 6 pm at a McDonald's across the street from the mall, which was filled with people doing their weekend shopping. As dozens of shots rang out, terrified shoppers ran from the scene, some carrying babies and pushing strollers.
Video obtained by The Associated Press from German news agency NonstopNews showed two bodies with sheets draped over them not far from the fastfood restaurant. Another video posted online showed a gunman emerging from the door of the McDonald's, raising what appeared to be a pistol with both hands and aiming at people on the sidewalk, firing as they fled in terror.
He told German broadcaster n-tv that he heard the attacker yell an anti-foreigner insult and "there was a really loud scream."
He said he saw only one attacker, who was wearing jack boots and a backpack.
"I looked in his direction and he shot two people on the stairs," Zequiri said. He said he hid in a shop, then ran outside when the coast was clear and saw bodies of the dead and wounded on the ground.