Witnesses said the Westgate Mall was raided by men armed with AK-47s who first set off grenades, the Daily Nation reported. The men with their faces covered used three separate entrances.
Police said about 600 people were evacuated. About 150 were injured, some by shrapnel, officials said.
President Uhuru Kenyatta said at least 39 people had been killed, including some of his relatives, CNN reported. Early Sunday, gunmen remained in the mall, and authorities were unsure if they were holding hostages.
Al-Shabaab used Twitter shortly after the attack to claim responsibility, the Nation said.
"The Mujahideen entered #Westgate Mall today at around noon and are still inside the mall, fighting the #Kenyan Kuffar inside their own turf," one statement said, adding "What Kenyans are witnessing at #Westgate is retributive justice for crimes committed by their military."
While al-Shabaab said there had been 100 deaths, the Kenyan Red Cross said 30 people had been confirmed killed and 60 injured, the Nation said.
The Obama administration released a statement in Washington extending condolences to the families of those killed and to U.S. citizens wounded in the attack.
"The perpetrators of this heinous act must be brought to justice, and we have offered our full support to the Kenyan government to do so," Caitlin Hayden, a spokeswoman for the National Security Council, said. "We will continue to stand with the Kenyan people in their efforts to confront terrorism in all its forms, including the threat posed by al-Shabaab. This cowardly act against innocent civilians will not shake our resolve."
Westgate Mall is located in an upscale part of Nairobi, about 2 miles from the central business district. The mall includes a large supermarket, a Barclays bank, clothing stores and movie theater.
The mall is supposed to have tight security with people and vehicles checked as they enter, the Nation said.