md5sum should reside in /usr/bin/ (default location set by coreutils; and benefit is that it's in the PATH).
However for my example just put md5sum in the same directory as the qemu .deb file and it'll work. It's very portable.