Just before 3pm on Friday, a stolen beer truck barrelled for several hundred metres down Drottninggatan, Stockholm's biggest pedestrian street, before slamming into the front of the Åhléns department store.
The attacker fled the scene, with police arresting the Uzbek man on Friday evening.
On Saturday police said they had found a suspect device in the cab of the truck.
Swedish authorities said four people were killed and 15 were injured.
The Foreign Office in London confirmed that a British man, 41-year-old Chris Bevington who was a top executive at Sweden-based music streaming company Spotify, was among the dead. Belgian foreign ministry also said a Belgian woman had been killed. One of the Swedes was an 11-year-old girl who was on her way home when she lost her life. The other was a woman from Uddevalla.
Nine people remain in hospital, two of them seriously injured, according to health authorities.
Who was the attacker?
Authorities have yet to name the man suspected of carrying out the attack, but police said on Sunday that he was known to have “shown interest for extremist organizations” such as the Islamic State group.
Swedish media on Sunday named the suspect as Rakhmat Akilov, an Uzbek construction worker and father-of-four who went underground to avoid being deported from Sweden.
He had also been refused residency in Sweden, having been warned in December 2016 that he had a month to leave the country.
By February this year, his case was handed over to police, police chief Jonas Hysing told reporters in Stockholm on Sunday.
A second suspect, whose identity was not disclosed, was arrested on Sunday. That person can be detained until Wednesday, at which point prosecutors would have to ask a court for permission to extend their detention.
The Stockholm attack followed a string of similar assaults in Europe using vehicles.
The deadliest came in France on the Bastille Day national holiday in July 2016 when a man rammed a truck into a crowd in the Mediterranean resort of Nice, killing 86 people.
Last month, Khalid Masood, a 52-year-old convert to Islam known to British security services, drove a car at high speed into pedestrians on London's Westminster Bridge before launching a knife attack on a policeman guarding the parliament building. Five people were killed in the attack, while Masood was shot dead by police.
In 2010, another section of Drottninggatan was the scene of Sweden's only other terror attack, when a suicide bomber blew himself up, killing only himself and slightly injuring several others.
READ ALSO: The latest on the Stockholm truck attack